Strong Passwords, Explained: What Actually Makes One Secure

Every few months another breach dumps millions of passwords online, and every time, the same patterns show up at the top of the list: 123456, password, qwerty. Here's what actually makes a password hard to crack, and it's not what most sites tell you.

Length matters more than complexity

A password's strength comes from how many guesses an attacker needs to make before finding it, its entropy. Adding length increases that number exponentially; swapping letters for symbols barely moves it.

correcthorsebatterystaple (25 characters, all lowercase) is dramatically harder to brute-force than P@ssw0rd! (9 characters with every trick a "strength meter" asks for), because length multiplies the search space far more than character variety does. Forcing "at least one symbol, one number, one uppercase letter" mostly just pushes people toward predictable substitutions (@ for a, 0 for o) that cracking tools already check for first.

The practical takeaway: aim for length (16+ characters) over cleverness. A long random string, or a random string of unrelated words, beats a short "clever" one every time.

Passphrases: long but memorable

For the few passwords you do have to remember, a passphrase is the best tool: four or more unrelated words chosen at random, such as lantern-gravel-oyster-meadow. It is easy to type and remember, and its length makes it very hard to guess.

The key word is random. A phrase you picked yourself, such as a song lyric, a quote or your pet's name plus a year, is far weaker than it looks, because attackers' guessing lists are built from exactly those things. Pick the words with a generator or dice, not by feel.

How passwords actually get cracked

It helps to know what you're defending against:

• Credential stuffing. A breach exposes your email and password from one site, and bots automatically try the same pair on hundreds of other sites. No guessing involved.
• Dictionary and rule-based attacks. Tools try common words, names, dates and every typical substitution first, then mutate them (Summer2026!). Anything that looks "clever" but is built from a real word falls quickly.
• Brute force on stolen hashes. When a site is breached, attackers often get hashed passwords and guess them offline at enormous speed. Long, random passwords are what survive this.
• Phishing. A convincing fake login page needs no cracking at all. No password strength helps if you type it into the wrong site.

The real threat isn't guessing, it's reuse

Nobody sits at a login screen guessing passwords one at a time. The real risk is reuse: if one site leaks your password and you used it elsewhere, those accounts are compromised too, instantly, with zero guessing involved.

This is why a single strong password you reuse everywhere is worse than several random ones, no matter how long it is. One breach anywhere becomes a breach everywhere.

What current guidance says

Security guidance has shifted away from the old rules. Modern recommendations, such as those from NIST, favor:

• Length over composition rules. Don't force symbols and capitals; allow long passwords and passphrases.
• Checking against known-breached passwords rather than judging only by pattern.
• No forced periodic changes. Making people rotate passwords every 90 days leads to predictable tweaks (Spring1, Summer1). Change a password when there's a reason to, such as a breach or suspected compromise.

What this actually means for you

1. Use a different, random password for every account. This is the single highest-leverage habit. It means one leaked site can't cascade into others.
2. Let a tool generate them. You're not supposed to memorize dozens of 20-character random strings; that's what a password manager is for. Our Password Generator creates long, random passwords with custom length and character rules whenever you need one.
3. Save your memorization budget for a few things that matter: your password manager's master password, your email, and anything without two-factor authentication available. Make those long and memorable; let everything else be random and stored.
4. Turn on two-factor authentication wherever it's offered. It stops credential-stuffing cold, even if a password does leak. An authenticator app or a hardware key is stronger than a text message.
5. Secure your email first. Whoever controls your email can reset every other password, so it deserves your longest passphrase and two-factor protection.

Common mistakes to avoid

• Reusing a password "just for unimportant sites". Attackers don't care which sites you consider unimportant.
• Using personal details such as names, birthdays, pets or addresses, all of which are easy to find.
• Storing passwords in a notes file, a spreadsheet or a browser extension you don't trust.
• Sharing passwords over chat or email. Use your password manager's sharing feature or a proper invite instead.
• Ignoring breach notifications. If a service tells you it was breached, change that password and any other account that shared it.

Choosing usernames too

Passwords are only half of a login. A distinctive, non-obvious username adds a little friction for attackers and keeps your accounts from being linked together. Our Username Generator can suggest options, and if you want to see how the random strings are made, our Hash Generator shows what a hash looks like, the form sites should store your password in instead of the password itself.

Strong passwords aren't about outsmarting a hacker typing guesses by hand. They're about surviving the next breach that has nothing to do with you.

Related tools

Put this into practice:

• Password Generator
• Username Generator
• Hash Generator