Most of us were taught that a strong password looks something like P@ssw0rd!. Unfortunately, attackers were taught the same thing. Password-cracking software knows every common substitution — a to @, o to 0, an exclamation mark at the end — and tries them first. Real strength comes from somewhere else.
How passwords are actually cracked
When a website is breached, attackers often get a database of scrambled (“hashed”) passwords. They then use powerful computers to guess billions of candidates per second, starting with lists of real leaked passwords, dictionary words, names, dates and the usual tricks. They also take email-and-password pairs from one breach and try them on other sites, a technique called credential stuffing.
That gives us the two golden rules of password security:
- Your password must not be guessable from lists of words, names or common patterns.
- Every account needs a different password, so one breach cannot unlock the others.
Length beats complexity
Strength is about how many possibilities an attacker must search through. Each extra character multiplies that number. An 8-character password using every keyboard symbol has roughly 6 quadrillion combinations — which sounds like a lot until you learn that dedicated hardware can try that many in hours. A 16-character password from the same set has so many combinations that brute-forcing it is not realistic.
Security agencies such as the US National Institute of Standards and Technology now recommend favouring long passwords and passphrases over short, complicated ones, and they discourage forcing users to change passwords regularly without a reason.
| Password | Approximate strength |
|---|---|
Summer2026! | Weak — a word, a year and a symbol |
Tr0ub4dor&3 | Weak to fair — predictable substitutions |
velvet-orbit-kettle-marsh | Strong — four random words |
q7#Lm2v!Xr9pW4tz | Very strong — 16 random characters |
Method 1: let a generator do it (best for most accounts)
For the dozens of logins you never type by hand — shopping sites, streaming, forums — there is no reason to invent anything. Use a password generator to create a random 16–20 character password and store it in a password manager. Our generator runs entirely in your browser using cryptographically secure randomness, and the password is never transmitted anywhere.
Method 2: the random-word passphrase (best for passwords you must type)
A handful of passwords must live in your head: your computer login, your phone, and your password manager's master password. For these, use a passphrase of four to six genuinely random words, for example velvet orbit kettle marsh. It is long, hard to guess and surprisingly easy to remember if you picture a silly scene — a velvet kettle orbiting a marsh.
The key word is random. Song lyrics, quotes and your favourite things are not random; they are in the attacker's dictionary. Pick words by opening a book at random pages or by using dice and a word list.
Use a password manager
Nobody can remember 100 unique random passwords, and you shouldn't try. A password manager stores them encrypted, fills them in automatically, and warns you about reused or breached passwords. Reputable options exist for every platform, including free ones and those built into modern browsers and phones. You then only need to remember one strong master passphrase.
Turn on two-factor authentication
Even a perfect password can be stolen by a phishing page. Two-factor authentication (2FA) adds a second check — a code from an app, a security key or a passkey — so a stolen password alone is not enough. Enable it first on your email account, because email is the key that resets every other password.
Quick checklist
- At least 12 characters for normal accounts, 16+ for important ones.
- A unique password for every account — never reuse.
- Random, not personal: no names, birthdays, pets or favourite teams.
- Store passwords in a password manager.
- Enable two-factor authentication or passkeys wherever offered.
- Change a password immediately if a service reports a breach.
Start today with your email account: generate a fresh password, save it in your manager and switch on 2FA. It takes five minutes and protects everything else.
