Guide
How to Create a Strong Password (and Actually Remember It)
Most password advice is folklore. Here is what actually makes a password hard to crack, how to build one you can remember, and when to stop trying and let a generator do it.
What actually makes a password strong
Strength comes from unpredictability — how many guesses an attacker needs on average. Length contributes far more than exotic symbols: every extra character multiplies the search space, while swapping a for @ is a substitution every cracking tool tries first.
- Length beats complexity. A 16-character password is dramatically harder to brute force than an 8-character one, whatever symbols it contains.
- Randomness beats cleverness. Attackers start with leaked password lists, dictionaries and keyboard patterns, not with A-Z-a-z-0-9 from the top.
- Uniqueness beats everything. A perfect password reused across sites is only as safe as the least careful site that stores it.
The passphrase method: strong and memorable
When you must memorise a password — your device login, your password manager's master password — use a passphrase of four to six unrelated words rather than one mangled word.
- Pick words that have no story linking them: copper · lantern · drift · walnut.
- Join them with a separator you always use, such as a hyphen or a period.
- Add one digit and one symbol somewhere that is not the end.
- Never use song lyrics, quotes, names, birthdays or sports teams — all are in wordlists.
The result is long, high-entropy and easy to picture. The trade-off: you can only truly memorise a handful of these, so reserve them for the few passwords you type by hand.
When to use a random generator instead
For every other account — the dozens you log into with a saved credential — memorability is a liability, not a feature. A random 16-character string generated with a cryptographically secure source is stronger than anything a human invents, and your browser or password manager does the remembering.
The Password Generator builds passwords entirely in your browser using crypto.getRandomValues(), guarantees a mix of lowercase, uppercase, digits and symbols, and stores nothing — no cookies, no network requests, and a clipboard wipe button for after you paste.
Habits that matter more than the password itself
- Turn on two-factor authentication wherever it is offered — it survives a leaked password.
- Use a password manager so every site gets a different random secret.
- Change a password when a service reports a breach, not on an arbitrary schedule.
- Clear clipboard history after pasting a password (on Windows, Win + V).
Quick answers
How long should a password be?
Twelve characters is a reasonable floor; sixteen is a better default for anything valuable.
Are random passwords worth it if I cannot remember them?
Yes — pair them with a password manager and remember one strong passphrase instead of fifty weak ones.
Do symbols really help?
They widen the character set, but adding four more characters helps more than adding one symbol.