Strong Passwords, Without the Headache
Most advice about passwords is either useless ("don't use 'password'") or actively counterproductive (forcing a symbol, a number, and a capital letter, which just trains everyone to write Password1!). Let's cut through it. Strong passwords come down to a few ideas that genuinely matter.
Length does the heavy lifting
Here's the counterintuitive truth: a long, simple password beats a short, complicated one. Every extra character multiplies the number of combinations an attacker has to try. A twelve-character password is the practical floor; sixteen or more is where you want to be for anything that matters, like your email or your bank. The symbols are nice, but they're the garnish, not the meal.
The mistake that actually gets people hacked
It isn't weak passwords, usually. It's reused ones. When a website you signed up for years ago gets breached, those leaked credentials get tried against every other major service automatically. If you used the same password on your email, the attacker now has your email — and from there, password resets hand them everything else. One unique password per account isn't paranoia; it's the single highest-impact habit you can build.
Stop trying to be random in your head
Humans are terrible at randomness. We reach for names, birthdays, the city we grew up in, a keyboard pattern like qwerty. Attackers know this and test those patterns first. A generator sidesteps the problem entirely by pulling from a secure random source. Our Password Generator uses the browser's built-in cryptographic engine, and nothing it creates is ever stored or transmitted.
"But I can't remember sixteen random characters"
You're not supposed to. This is what a password manager is for — you remember exactly one strong master password, and it handles the rest. If a manager feels like a step too far right now, a decent middle ground is a passphrase: four or five unrelated words strung together. Something like copper-lantern-mango-drift is long, easy to recall, and surprisingly hard to crack.
A quick checklist
- Twelve characters minimum, more for important accounts.
- A different password everywhere — no exceptions for the "unimportant" sites.
- Let a generator or a passphrase handle the randomness.
- Store them in a reputable password manager.
- Turn on two-factor authentication wherever it's offered.
Found this useful? Browse all our free online tools or read more on the blog.