How to create a strong password

Three methods that hold up against real cracking tools, with fresh examples generated on your device, and the habits that quietly undo them.

The short version

  1. Make it long. 16+ characters if random, 6+ words if a passphrase.
  2. Make it random. Chosen by a generator or dice, not by you.
  3. Make it unique. One password per account, no exceptions.
  4. Store it well. A password manager, plus two-factor authentication on important accounts.

Method 1: a random password from a generator

Best for every account a password manager can fill for you, which should be nearly all of them. You never need to remember or type it. Open the password generator, set 20 characters, copy, save.

Method 2: a random-word passphrase

Best for the handful of passwords you must remember: your password manager’s master password, your computer login, your email. Six random words from the EFF list give 77.5 bits. The passphrase generator picks them for you, and explains how the dice method works.

Method 3: a random-word sentence

If a site insists on capitals, digits and symbols, take random words and wrap them in the required characters: capitalise the first word, drop a random two-digit number in the middle, end with a symbol. The words carry the strength; the extras satisfy the form.

Habits that make passwords weak

  • Reuse. The single biggest risk. Attackers take leaked email-and-password pairs from one breach and try them everywhere (“credential stuffing”).
  • Personal details. Pet names, birthdays, teams and street names are public on social media and are the first things targeted guessing tries.
  • Predictable tweaks. Capital at the start, number and “!” at the end, o → 0. Cracking rules apply these automatically.
  • Keyboard walks. qwerty, 1qaz2wsx and asdfgh are in every wordlist.
  • Scheduled changes. Forced rotation produces Autumn2026 → Winter2026. NIST dropped it from its guidance for this reason.

Test one you already use with the password strength checker. It runs in your browser and shows the patterns a cracker would spot.

Questions people ask

What is the best way to create a strong password?

Let a password manager or a password generator create it: 16 or more random characters, different for every site. For the few passwords you must memorise, use a passphrase of six or more randomly chosen words.

Are password ideas from the internet safe to use?

No. Any specific password published online can end up in a cracking wordlist. Use a method, like random words or a generator, rather than a ready-made example. That is why this guide shows methods and generates fresh examples in your browser instead of listing passwords.

Should I change my passwords regularly?

NIST SP 800-63B advises against forced periodic changes because they push people toward predictable patterns such as Spring2025 becoming Summer2025. Change a password when there is evidence it was exposed, or if you reused it.

Is it OK to write passwords down?

A written list kept somewhere physically secure at home is safer than reusing one weak password everywhere. A password manager is better still, because it also fills passwords only on the right website, which protects against phishing.

Is a sentence a good password?

A long sentence is better than a short word, but sentences people make up follow grammar and favourite phrases, so they are more guessable than they look. Randomly chosen words give you the length without the predictability.

Other tools on the key ring

Password generatorRandom, strong passwords from your browser’s CSPRNG.Passphrase generatorEFF Diceware word passphrases you can actually remember.Bulk password generator10 to 500 passwords at once, CSV or TXT export.Password strength checkerPattern-aware scoring, crack times and a private breach check.Password entropy calculatorBits of entropy from pool size and length, with the formula.PIN generatorRandom 4, 6 or 8-digit PINs that skip the obvious ones.Wi-Fi password generatorWPA2/WPA3 keys plus a QR code guests can scan.Random string generatorRandom strings from any alphabet, one or many.API key & secret generatorAPI keys, JWT secrets and tokens in hex, Base64url or Base62.UUID generatorUUID v4 and time-ordered v7, singly or in bulk.Bcrypt generator & checkerHash a password with bcrypt and verify a hash.Hash generatorSHA-256, SHA-512, SHA-1 and MD5 of any text.TOTP generator2FA codes from a Base32 secret, step by step.Username generatorRandom usernames that don’t reveal who you are.Password policy generatorA NIST-aligned password policy written for your organisation.