How to Create a Strong Password (And Check If Yours Is Actually Secure)

Why Password Security Still Matters in 2024

Despite years of security awareness campaigns, weak passwords remain the leading cause of account compromise. The most common passwords in leaked databases year after year are still 123456, password, and qwerty. Even people who know better often reuse the same moderately-strong password across dozens of accounts — a practice nearly as dangerous as using a weak one.

The consequences of a compromised account can range from mildly inconvenient (a spam email sent in your name) to catastrophic (financial fraud, identity theft, business data breach).

What Makes a Password Strong?

Password strength comes down to one fundamental factor: entropy — how hard it is for an attacker to guess your password. Entropy increases with both length and character variety.

Length Is the Most Important Factor

A brute-force attack tests every possible combination of characters. The time required scales exponentially with password length:

• 6 characters (lowercase only): cracked in milliseconds
• 8 characters (mixed case + numbers): a few hours on modern hardware
• 12 characters (mixed case + numbers + symbols): years
• 16+ characters: effectively uncrackable by brute force with current technology

The minimum recommended length for any important account is 12 characters. For critical accounts (banking, email, business accounts), aim for 16+.

Character Variety Increases Complexity

Using a mix of character types dramatically increases the number of possible combinations:

• Lowercase only (26 chars): 26^n combinations for n characters
• Mixed case (52 chars): 52^n combinations
• Mixed case + numbers (62 chars): 62^n combinations
• Mixed case + numbers + symbols (94 chars): 94^n combinations

A 12-character password using all character types has roughly 475 quadrillion possible combinations — exponentially more than a 12-character lowercase-only password.

Avoid Predictable Patterns

Attackers don't always brute-force every combination. Dictionary attacks use lists of common words, names, phrases, and keyboard patterns. A password like P@ssw0rd! looks complex but appears in almost every password cracking dictionary — character substitutions like @ for a and 0 for o are well-known and tested first.

Strong passwords avoid:

• Dictionary words, even with number/symbol substitutions
• Keyboard patterns (qwerty, 123456, zxcvbn)
• Personal information (birthdays, names, pet names, addresses)
• Sequential or repeated characters (aaa111, abcdef)

The Passphrase Approach

Passphrases — strings of multiple random words — offer an excellent balance of security and memorability. For example: correct-horse-battery-staple (the famous XKCD password comic). This approach produces a long, highly random password that's actually writable and memorable.

A passphrase of 4–5 random, unrelated words (not phrases you'd find in a book or song) can be more secure than a shorter but more "complex" random string, while being much easier to type and remember.

Check Your Password Strength

Not sure how strong your existing passwords are? Our free Password Strength Checker analyzes your password and tells you:

• Estimated time to crack
• Strength rating (Very Weak to Very Strong)
• Specific weaknesses detected (too short, common word, etc.)

The tool processes everything locally in your browser — your password is never sent to any server.

Generate a Secure Password

The most reliable way to create a strong, unique password for every account is to use a random password generator. Our free Password Generator creates cryptographically random passwords with your choice of length and character types.

Combined with a password manager (Bitwarden, 1Password, KeePass), you can use a unique, 20-character random password for every account without having to memorize any of them.

Password Security Best Practices

• Use a unique password for every account — password reuse is how one breach compromises dozens of accounts
• Use a password manager — it generates and remembers strong unique passwords so you only need to remember one master password
• Enable two-factor authentication (2FA) — even a strong password can be stolen via phishing; 2FA stops attackers who have your password
• Change passwords after breaches — check HaveIBeenPwned.com to see if your email appeared in a known data breach
• Don't share passwords — if you must share access to an account, use a service like LastPass sharing or a dedicated team account

Conclusion

A strong password is long, random, and unique to each account. With a password manager doing the heavy lifting, there's no good reason to use weak or reused passwords today. Start by checking your current passwords with our Password Strength Checker, then use the Password Generator to replace any weak ones.