How to Create Strong Passwords You'll Remember
Simple rules and a free generator to build passwords that are both secure and usable.
Length beats complexity — a long passphrase is both harder to crack and easier to remember than a short string of random symbols. Aim for at least 12–16 characters, mix character types, and never reuse passwords across sites. A 16-character password using the full character set (letters, digits, symbols) has roughly 105 bits of entropy — astronomically harder to brute-force than an 8-character one at around 52 bits, since each added character multiplies the possibility space rather than adding to it.
What makes a password strong?
Length beats complexity. A long passphrase is both harder to crack and easier to remember than a short string of random symbols, since each additional character multiplies the number of possible combinations an attacker would need to try. Aim for at least 12–16 characters and avoid reusing passwords across sites — reuse means a single leaked password can compromise every account it was used on.
A password manager removes the tension between "long and random" and "memorable" entirely — you only need to remember one strong master password, and the manager generates and stores a unique, high-entropy password for every other site.
Understanding entropy: why length wins
Entropy, measured in bits, quantifies how many guesses an attacker would need to try, on average, to find a password by brute force — each additional bit of entropy doubles that number. A password's entropy is calculated as length × log₂(character set size), which is why length has an outsized effect: going from 8 to 16 characters doesn't just double the difficulty, it raises it exponentially, since every added character multiplies the total possibility space rather than adding to it.
This is also why a short but "complex" password (say, 8 characters mixing everything) can actually have less entropy than a longer but simpler passphrase of random words — the math consistently favors length over forcing complexity into a short string.
Rules for strong passwords
- Use 12+ characters, ideally 16 or more
- Mix upper, lower, numbers and symbols
- Never reuse passwords across different sites
- Avoid names, dates and dictionary words
- Use a password manager to store unique passwords per site
Entropy by length and character set
| Character set | 8 characters | 12 characters | 16 characters |
|---|---|---|---|
| Lowercase letters only | ~38 bits | ~56 bits | ~75 bits |
| Upper + lowercase | ~46 bits | ~68 bits | ~91 bits |
| Letters + digits | ~48 bits | ~72 bits | ~95 bits |
| Letters + digits + symbols | ~52 bits | ~79 bits | ~105 bits |
Generate one instantly
- Open the Password Generator.
- Choose your length and character types.
- Copy your secure password.
- Store it in a password manager.
Passphrases: an easier way to hit high entropy
A passphrase strings together several random, unrelated words — something like "correct horse battery staple" — rather than a single word with substitutions. Because each word is chosen from a large dictionary (often several thousand common words), each additional word adds substantial entropy, and four or five random words can comfortably exceed the entropy of a much shorter "complex" password.
The key word is random — a memorable phrase you already know, like a movie quote or a common saying, is far easier to guess than truly random word selection, since it draws from a much smaller, predictable pool of phrases people actually use. A password manager or generator that picks genuinely random words from a large list preserves the memorability benefit while keeping the randomness that entropy depends on.
Common pitfalls and best practices
- Using predictable substitutions. Replacing "a" with "@" or "o" with "0" adds almost no real entropy, since these substitutions are the first thing cracking tools check.
- Reusing a password across multiple sites. A single breach at any one site then compromises every account using that password — unique passwords per site contain the damage of any one leak.
- Basing passwords on personal information. Names, birthdates, and pet names are exactly what targeted guessing attempts try first, since they're often discoverable from public information or social media.
- Storing passwords in an unencrypted document. A plain text file or spreadsheet of passwords is a single point of failure — use a proper password manager with its own encryption instead.
Frequently Asked Questions
- Generally yes — entropy scales with length more powerfully than with character variety, so a longer passphrase of random words often has more entropy than a shorter password crammed with symbols, while also being easier to remember.
- Current security guidance generally favors changing a password only when there's reason to believe it's been compromised, rather than on a routine schedule — frequent forced changes tend to push people toward weaker, more predictable passwords.
- Reputable password managers use strong encryption and are generally considered far safer than reusing passwords or storing them in an unencrypted document — the security community broadly recommends using one.
- Marginally, but predictable patterns like appending "1" or "!" are well known to cracking tools and add far less real entropy than the character count alone would suggest — random placement matters more than just including the character types.
- No — password generation runs entirely locally in your browser, so the generated password is never transmitted anywhere before you copy and use it.