How to Create Strong Passwords That Actually Protect You
"P@ssw0rd123" feels strong. It has a capital letter, a symbol, and a number, ticking every box a signup form usually asks for. It is also one of the first passwords a cracking tool will try, because swapping letters for look-alike symbols is a pattern attackers have accounted for since the early 2000s. Real password strength has less to do with clever substitutions and more to do with math.
What Actually Makes a Password Hard to Crack
Password strength comes down to entropy — roughly, how many guesses an attacker would need to try before finding it. Two things drive entropy: length, and true randomness. A long, truly random password is exponentially harder to crack than a short, clever-looking one, even if the short one has symbols and numbers mixed in.
Consider the difference between Tr0ub4dor&3 (a famous example from an XKCD comic, 12 characters, looks complex) and a randomly generated 16-character string. The random string, despite looking less "clever" to a human, has vastly more entropy because an attacker can't rely on any human pattern to narrow the search.
The Habits That Actually Matter
- Length over complexity. Aim for at least 12-16 characters. Every additional character multiplies the number of possible combinations far more than adding a symbol does.
- True randomness beats "clever" patterns. Substituting "a" with "@" or "o" with "0" is a well-known trick that cracking dictionaries already include. A password generator that pulls from a cryptographically secure random source produces something no pattern-matching tool can predict.
- Never reuse passwords across accounts. This is arguably more important than the strength of any single password. If one site you use is breached (and breaches happen constantly, even to major companies), a reused password lets attackers walk straight into your other accounts — a technique called credential stuffing.
- Use a password manager. The only realistic way to have a unique, random, 16+ character password for every account is to let software generate and store them for you. You only need to remember one strong master password.
- Turn on two-factor authentication (2FA) wherever it's offered. Even a great password can be phished. 2FA means a stolen password alone usually isn't enough to get in.
What About Password "Rules" Like Special Characters?
Many sites still force you to include an uppercase letter, a number, and a symbol. This isn't harmful, but it isn't the most important factor either — it mainly exists to filter out extremely weak, short passwords like "password1". If you're already using a long, randomly generated password, these requirements are usually satisfied automatically and add little extra real-world protection.
A Simple System You Can Actually Follow
Use a password manager for anything you can. For the handful of passwords you truly need to remember (like your device passcode or your password manager's master password), a random passphrase of 4-6 unrelated words is both memorable and has excellent entropy — often better than a shorter string of random characters, and far easier to recall.
Need a strong password right now?
Generate a Secure Password