How to Create Strong Passwords (and Why Length Wins) 2026

Weak passwords are still the number-one way accounts get broken into — not through clever hacking, but through guessing, reuse and leaks. The good news is that creating strong passwords is simple once you understand what actually makes a password hard to crack. This guide explains why length beats complexity, how attackers really work, and how to build and manage passwords you can trust.

What makes a password strong?

The strength of a password comes down to entropy — a measure of how unpredictable it is. The more possible combinations an attacker would have to try, the stronger the password. Two things drive entropy:

• Length — every extra character multiplies the number of possibilities.
• Variety — using lowercase, uppercase, digits and symbols increases the choices per character.

Of the two, length matters far more. A short password with symbols is still short. You can see this trade-off for yourself with the Password Strength Checker, which estimates entropy and crack time as you type — entirely in your browser.

Why length beats complexity

For decades we were told to use passwords like P@ssw0rd! — short but "complex." The problem is that attackers know all those substitution tricks: replacing "a" with "@" or "o" with "0" adds almost nothing, because cracking software tries those variations automatically. Meanwhile, a longer passphrase of ordinary words is both easier to remember and dramatically harder to crack.

Compare two passwords. Tr0ub4! has seven characters and looks complex, but it can fall in seconds. correct-horse-battery-staple is long, simple to remember, and would take an impractical amount of time to brute-force. Length wins because each added character multiplies the search space exponentially.

How attackers actually crack passwords

Understanding the threat makes the advice obvious. Attackers rarely sit at a login screen typing guesses — rate limits stop that. Instead:

• Credential stuffing. When one site is breached, attackers take the leaked email-and-password pairs and try them on hundreds of other sites, because so many people reuse passwords. This is why reuse is the single biggest risk.
• Offline brute force. If a site's password database leaks, attackers run it on fast hardware, trying billions of guesses per second against the stored hashes. Length is your defence here.
• Dictionary and rule-based attacks. They start with common passwords, real words and predictable patterns (a capital letter first, a number and symbol last) before trying anything random.

Good sites slow offline attacks by storing passwords with a deliberately slow, salted hash like bcrypt — you can read how that works in our guide to hashing and bcrypt. But you cannot rely on every site doing that, so your password must be strong on its own.

How to create a strong password

There are two good approaches, depending on whether you need to remember it.

For passwords you must memorise

Use a passphrase: four or more random, unrelated words joined together, ideally with a number or symbol mixed in. "random" is the key word — a famous quote or song lyric is predictable. Aim for something like four words you would never normally string together. It is long, memorable and strong.

For everything else

Use random, unique passwords of at least 16 characters, generated for you. You should not try to invent randomness in your head — people are bad at it and fall into patterns. The free Password Generator creates strong random passwords with a strength meter, and nothing is ever stored or sent anywhere.

The rules that actually matter

• Make every password unique. One password per account means one breach cannot cascade into many.
• Go long. Aim for 16+ characters where the site allows it; longer for anything important.
• Avoid personal information. Names, birthdays, pet names and favourite teams are the first things guessed.
• Avoid keyboard patterns. "qwerty," "123456" and "asdfgh" are in every attacker's first list.
• Do not just add "1" or "!" to an old password. Predictable modifications are predictable.

Use a password manager

Nobody can remember dozens of unique 16-character passwords — and you should not try. A password manager generates, stores and fills strong passwords for you, so you only need to remember one strong master passphrase. It also means your passwords are never the weak, reused kind. This single habit does more for your security than any other.

Turn on two-factor authentication

Even a perfect password can leak. Two-factor authentication (2FA) adds a second step — usually a time-based code from an authenticator app — so a stolen password alone is not enough to get in. Enable it everywhere that offers it, especially email, banking and anything financial. You can see how time-based one-time codes are generated with the 2FA Code Generator. App-based codes are stronger than SMS, which can be intercepted through SIM-swapping.

What to do after a breach

If you learn that a service you use has been breached, act quickly: change that password immediately, and change it anywhere else you reused it (another reason never to reuse). Enable 2FA if you had not already, and watch for phishing emails that try to exploit the leak. Checking the strength of your replacement with the Password Strength Checker takes seconds and confirms you are not repeating an old mistake.

Key takeaways

Strong passwords are long, unique and unpredictable — length matters more than clever symbol substitutions, because attackers automate those tricks. Never reuse passwords, avoid personal details and keyboard patterns, and let a password manager generate and remember random ones for you. Add two-factor authentication on top. To build a strong password now, use the Password Generator, and test any password's strength with the Password Strength Checker.