How to Create a Strong Password

Weak, reused passwords are behind a huge share of account breaches. The good news: creating strong ones is easy, and you don’t have to remember them. This guide explains what “strong” really means and how to do it right.

Length beats complexity

Every character you add multiplies the number of possible passwords, so length is the single biggest factor in strength. A 16-character password is astronomically harder to crack than an 8-character one, even a “clever” one. Aim for at least 16 characters wherever a site allows it; the generator goes up to 128.

What the entropy figure means

The generator reports strength as entropy in bits — how unpredictable the password is, given the pool of characters each position was drawn from. With all four character types switched on, that pool is 94 characters, so every character contributes about 6.55 bits. Below 40 bits reads as Weak, 40–59 as Fair, 60–89 as Strong, and 90 or more as Very strong.

The figure follows the pool you actually chose, not the one on offer. Turn a character type off, or exclude some characters, and the pool shrinks and the bits fall to match — which is the honest way to show what a readability choice costs you.

The three exclusions, and what they cost

Underneath the character types are three options that take characters out:

• Exclude Ambiguous Characters drops the ones you cannot tell apart on a screen or over the phone — i I l 1 L |, o O 0, and the quote-like punctuation. Worth it for anything you will read aloud or type from a printout.
• Exclude Brackets drops < > ( ) [ ] { }, which can break shell commands, CSV files and the occasional badly-written password field.
• No Repeated Characters uses each character at most once. This one also caps the length at the size of the pool, and it lowers the entropy more than people expect: each position has one fewer choice than the last, so the bits are log₂(pool) + log₂(pool − 1) + … rather than length × log₂(pool).

Both exclusions on together take the 94-character pool down to 70. At the default length of 10 that is 61.3 bits — still Strong, and noticeably easier to read back.

Randomness matters

Human-chosen passwords are predictable — we lean on names, dates and keyboard patterns that attackers’ tools try first. Truly random characters remove that predictability. The generator draws from your browser’s cryptographic randomness by rejection sampling, so no character is even slightly likelier than another, and it runs entirely on your device: nothing you create is sent over the network, stored, or written to the page’s address.

Using what it gives you

Press Generate for a password, Copy to put it on the clipboard, or Regenerate for another one from the same settings. If you change a setting after generating, the password on screen is marked as out of date and Copy is disabled until you press Generate again — so you can never copy one that no longer matches what the form says.

Never reuse passwords

Reuse is the real danger. When one site is breached, attackers try those same credentials everywhere else (“credential stuffing”). A unique password per account means one breach can’t cascade. Since no one can remember dozens of random strings, use a reputable password manager to store them.

A practical setup

1. Use a password manager as your vault.
2. Generate a long, random, unique password for every account.
3. Turn on two-factor authentication (2FA) wherever it’s offered — even a strong password benefits from a second layer.
4. Prioritise your email and bank accounts; email is the master key to password resets.

Passphrases as an alternative

If you must memorise one — like your password-manager master password — a passphrase of four or more random, unrelated words is both strong and memorable.

Generate cryptographically strong passwords now with the password generator.