How to create a strong password

The question usually arrives at an awkward moment: a breach notice lands in your inbox, or a bank refuses the password you have used for years. How do you create a strong password? The answer is simpler than most people expect, and it has far less to do with memorising a salad of symbols than you might think.

Below you will find what genuinely makes a password hard to guess, how to build a long password you can actually recall, and a short checklist for testing the one you already have. None of this takes longer than an afternoon.

A password's strength is the number of guesses it takes

A program trying to break into your account does not type like a person. It works from leaked lists and predictable patterns, running through millions of candidates a second. So a password's strength is not how messy it looks — it is how long that queue of candidates is. In other words: how many guesses have to be crossed off before yours comes up?

Two things lengthen that queue: how many different characters can sit in each position, and how many positions there are. The second is by far the cheaper win. In an eight-character password, widening the alphabet from lowercase letters to letters, digits and symbols multiplies the total by roughly thirty thousand. Adding three lowercase letters to that same password multiplies it by about seventeen thousand — and the fourth letter overtakes the symbols entirely, with nothing to memorise.

Security people shorten these totals to "bits", because the numbers stop being readable very quickly. Each bit doubles the number of guesses: a ten-bit gap means a thousand times longer search, a twenty-bit gap a million times longer. The Random Password Generator prints the bit value of every password it produces, so dragging its length slider for a few seconds shows you exactly where any given length lands.

Random words: a long password you can actually remember

The only real problem with a long password is recalling it. The fix is to string together random words instead of random characters: five of them get you close to thirty characters, readable at a glance and stored in your head as a small scene rather than a code. "melon-curtain-anchor-lantern-oven" is the shape of it, and it is far easier to type on a phone keyboard than a run of punctuation.

The whole method rests on the words being genuinely random. The first five words that come to mind are not random: people reach for related ideas, and guessing software knows the shortcuts people take. If you are wondering where to get truly unrelated words, the easiest source is already in the room. Open any book on your shelf at five random pages, take the first concrete noun at the top of the left-hand page each time, and close it again. Five openings, one password.

Save this method for the handful of passwords you must recall from memory: your computer login, your phone, your email account and the master password of a password manager if you use one. Building word chains for dozens of accounts becomes a chore — those are better filled with generated passwords and saved.

• The words must be picked at random; "it just came to me" is not random
• Do not form a sentence — familiar word order is the first thing guessing tools try
• Separate the words with hyphens or dots: easier to read, and extra length
• Aim for five words and never drop below four
• Keep names, birth years, teams and hometowns out of the chain

Reusing one password is the expensive habit

Personal accounts are rarely lost because someone cracked a password. They are lost because the password leaked somewhere else. A small shop or a forum you had forgotten about is breached, your email address and password land on a list, and that pair is then tried in order at banks, social networks and mail providers. Note what this means: in that scenario the strength of your password is irrelevant, because nobody is guessing — they already have it.

The only antidote is a different password for every account. You do not have to fix them all today; work down in order of what a stranger could do with each. Your email account belongs at the top, because every other service sends its password-reset link there. Whoever controls your inbox can open the rest one by one.

The second measure is two-step verification wherever it is offered. Even a leaked password will not get anyone in without the code from your phone or authenticator app. On most services you will find the switch under the account menu, in a section called "Security" or "Sign-in and security".

• First: your email account — every recovery path runs through it
• Second: banking, payment services and government portals
• Third: social networks and shopping accounts
• Last: one-off sign-ups you have not touched in years

Is my password strong? A six-question check

You can test the password you already use without typing it into anything. If the answer to even one of the questions below is yes, that password has earned a replacement. And avoid the sites that offer to score your password for you: there is no reason to hand a working password to a stranger in order to be told it is short.

• Is it shorter than twelve characters? Length is the one thing modern hardware cannot brute-force its way around
• Does it contain your name, your birth year, or the name of a child or a pet?
• Is it a dictionary word with a digit in front and an exclamation mark behind? Guessing tools try that pattern early
• Is it a run of keys that sit next to each other on the keyboard?
• Is the same password in use on another site?
• Is it sitting in plain sight somewhere — in an email, in phone notes, in a file on the desktop?

Where should these passwords live?

Nobody can hold dozens of strong passwords in their head, and nobody should try. Three storage options are sensible. A password manager keeps everything in an encrypted vault and leaves you one master password to memorise — which is exactly what the random-word method is for. Your browser's built-in password store is less flexible, but vastly better than doing nothing. And a notebook kept at home is the one method nobody can reach over the internet, however old-fashioned it looks.

The list of things to avoid is short: emailing passwords to yourself, sending them to yourself in a messaging app, and keeping a plain text file of them on the desktop. If you must keep a list as a file, lock that file with a password using the file encryption tool. Then even a stolen laptop gives up nothing, and the single thing you need to remember is that one password.

When is it actually worth changing a password?

"Change your password every ninety days" was a fixture of workplace policy for years, and most current security guidance has moved away from forcing it. The reason is what people actually do: told to change a password constantly, they increment the digit on the end rather than build something new, and the result is more predictable than what it replaced. Changing a long, unique password for no reason does not make it stronger.

The situations that do call for a change are clear, and none of them should wait: a breach notice from a service you use, realising the same password is in use elsewhere, having told it to someone, having signed in on a shared computer, or seeing activity on the account you do not recognise. In that last case a new password alone is not enough — find the "where you're signed in" list on the same settings page and end every other session, or whoever got in simply carries on from theirs.

Frequently asked questions

How long should a password be?

For passwords you type from memory, sixteen characters is a good target and twelve is the floor. For passwords you save rather than retype, extra length costs you nothing at all: twenty characters and up is perfectly comfortable.

Can you give examples of strong passwords?

Never use a published example as-is; a password printed on a web page is no longer secret. Examples are only there to show the shape: five random words joined by hyphens, or a generated run of sixteen to twenty characters. The fastest route to your own is to produce a batch in the Random Password Generator and save the one you like.

Do I need to change my password every three months?

No. Changing a long password that is used on one site only does not improve anything, and forced rotation pushes people towards easy patterns like adding a number on the end. A breach notice, a shared password, or unfamiliar activity on the account are the real reasons to change one.

Isn't a password manager risky — everything in one place?

Putting every password in one vault sounds alarming until you compare it with the usual alternative, which is one password everywhere. If you use a manager, build its master password with the random-word method, switch on two-step verification, and make sure you have a backup of the vault.

How do I find out whether my password has leaked?

Most current browsers and password managers compare your saved passwords against known breach lists and warn you when one matches; look for the check inside your browser's password settings. If a warning appears, change that account first, then every other account where the same password was used.

Last updated: August 27, 2026