How to Create a Strong Password (and Remember It) in 2026

Weak and reused passwords remain one of the easiest ways for attackers to break into accounts. The good news is that a strong password is easy to create — especially with a free password generator.

What makes a password strong?

• Length — at least 15 characters (16 or more is better). Every extra character multiplies the number of possible guesses.
• Randomness — no names, birthdays, keyboard patterns (qwerty) or common words.
• Variety — a mix of upper and lower case letters, numbers and symbols.
• Uniqueness — a different password for every account.

Why length beats complexity

A password’s strength is measured in bits of entropy. A random 8-character password using all character types has about 52 bits. A random 16-character password has over 100 bits — astronomically harder to crack. Our generator shows the entropy for every password so you can see the difference.

How to generate a strong password

1. Open the Password Generator.
2. Set the length to 16 or more.
3. Keep uppercase, lowercase, numbers and symbols ticked.
4. Click Copy and paste it into your password manager.

Passwords are created on your device using the browser’s cryptographically secure random number generator, and are never sent anywhere.

How to remember strong passwords

You don’t need to. Use a reputable password manager to store them, and memorise just one long master passphrase. Then turn on two-factor authentication (2FA) wherever it is offered.

Common password mistakes to avoid

• Reusing the same password on multiple sites.
• Adding “1” or “!” to the end of an old password.
• Storing passwords in plain-text notes or spreadsheets.
• Sharing passwords over chat or email.

Other handy security utilities

Need unique IDs for a project? The UUID Generator uses secure randomness too, and the Hash Generator shows how passwords are turned into fixed-length hashes. And remember that Base64 is encoding, not encryption — never use it to hide passwords.

See all free utilities.

Examples: weak vs strong

• Weak: Ali@1995 — a name and a birth year, the first things attackers try.
• Weak: P@ssw0rd! — symbol swaps like @ for a and 0 for o are built into cracking tools.
• Strong passphrase: four or more random, unrelated words, for example lantern-mango-orbit-pillow (do not reuse this one).
• Strong random password: 16 random characters made by the Password Generator — best kept in a password manager.

Why length beats complexity

Strength comes from how many guesses an attacker would need. Picking words at random from a list of 7,776 words gives about 52 bits of strength for four words and about 78 bits for six. Sixteen truly random characters from the 94 printable keyboard symbols give about 105 bits. Each extra bit doubles the work, so adding length is the easiest way to get stronger. That is why current guidance, such as NIST’s digital identity guidelines, focuses on length and checking passwords against known breaches rather than forcing complex rules.

Protect your accounts beyond the password

• Turn on two-factor authentication (an authenticator app or passkey is stronger than SMS).
• Use a different password for every account, so one leak does not unlock the rest.
• Check whether your email appears in known data breaches with a service such as Have I Been Pwned, and change any affected passwords.
• Use passkeys where websites offer them — they cannot be phished like passwords.

Frequently asked questions

How long should my password be?

Aim for at least 12 characters for random passwords, and at least 4 to 5 random words for passphrases. For email and banking, longer is better.

Should I change my password every few months?

Only if there is a reason, such as a breach or someone else knowing it. Forced regular changes tend to make people choose weaker, predictable passwords.

Is it safe to use an online password generator?

Use one that creates the password in your browser with a cryptographic random generator and never sends it anywhere, as ours does.

Are password managers safe?

Reputable password managers encrypt your vault with your master password, so they are much safer than reusing passwords. Protect the manager itself with a long passphrase and two-factor authentication.