How to Create a Strong Password (That You'll Actually Remember)

Runs 100% in your browser — nothing on this page is uploaded or stored. Most password advice is either vague ("use a strong password!") or paranoid. This guide takes the middle path: what actually makes a password strong, with real numbers, so you can make sensible trade-offs instead of memorizing arbitrary rules.

What "strong" actually means

A password's strength comes down to two things: how many possibilities an attacker must try (the search space) and how fast they can try them (the attack speed). Everything else — special characters, mixed case, avoiding dictionary words — is just a way to influence those two numbers.

The search space is simple multiplication. A password of length L drawn from a character set of size C has C^L possibilities. Security folks express this in bits of entropy: entropy = L × log₂(C). Each extra bit doubles the attacker's work. A 40-bit password takes twice as long to crack as a 39-bit one — and a 60-bit password takes about a million times longer than a 40-bit one. Length is the lever that matters most, because every character you add multiplies the search space by the whole character set.

Attack speed depends on the scenario. Guessing against a website's login form is slow — rate limits and lockouts mean an attacker might manage a handful of tries per second. But if a site's password database leaks, attackers can test guesses offline on their own hardware, reaching billions of guesses per second. Sensible advice assumes the worse case: the offline attack. That's not fear-mongering, it's just how the math has to be done — breaches happen regularly, and you can't control how a site stores your password.

Length beats complexity (with numbers)

Compare two common strategies. A 12-character password using all 94 printable ASCII characters (upper, lower, digits, symbols) has 94¹² ≈ 4.7 × 10²³ possibilities — about 78 bits of entropy. At 10 billion guesses per second, an offline attacker needs roughly 1.5 million years on average to find it. Comfortable.

Now take a 20-character password using only lowercase letters: 26²⁰ ≈ 2 × 10²⁸ possibilities, about 94 bits — 65,000 times stronger than the 12-character "complex" one, and far easier to type. Length wins because it compounds: each added character multiplies the search space, while adding a character type only enlarges the base once.

That doesn't mean complexity is useless — mixing character types does add real entropy (about 6.5 bits per character for the full 94-symbol set versus 4.7 for lowercase-only). It just means an 8-character password with symbols is not the fortress people imagine: 94⁸ ≈ 6 × 10¹⁵ possibilities falls in about 7 days at 10 billion guesses per second. If a site caps you at short passwords, complexity is your only lever — but whenever you can choose, add length first.

Worked examples: weak vs. strong

All estimates below assume a fast offline attack of 10 billion guesses per second and show average crack time (half the search space). Real attacks vary, and smart attackers try common passwords first — which is why the "weak" column is often worse in practice than the raw math suggests.

• "password123" — ~11 characters but entirely predictable. It appears in every breach list ever compiled: cracked instantly, zero guessing needed.
• "Sunshine2024!" — a dictionary word, a year, a symbol. Pattern-based attacks try exactly this shape: seconds to minutes.
• "Tr0ub4dor&3" — the famous example of complexity theater. Eleven characters, mixed types, but built from a dictionary word with leet-speak substitutions attackers long ago automated: roughly 3 days, and far less against a targeted attack.
• "jK9#mQ2$vL7x" — 12 random characters from the full set: ~78 bits, about 1.5 million years. Genuinely strong, genuinely unmemorable.
• "correct horse battery staple" — four random words from a ~7,776-word list: 7776⁴ ≈ 3.6 × 10¹⁵ possibilities, about 4 days at this attack speed. Weaker than it feels — add a fifth word and it jumps to ~90,000 years. Passphrases work, but they need five or more random words, and the words must be random, not a phrase you'd naturally pick.
• "correct horse battery staple orange" — five random words: ~64 bits, about 90,000 years. Strong and typable. This is the sweet spot for passwords you must memorize.

The honest takeaway: randomness is non-negotiable. Any pattern a human finds natural — words with meaning, dates, keyboard walks like "qwerty123" — is a pattern attackers have already encoded. If you can remember it easily without writing it down, assume it's weaker than the math says.

The rules that actually matter

1. Make it long. Aim for at least 14–16 random characters, or a 5+ word random passphrase for things you type often.
2. Make it random. Use a generator (like our free password generator, which uses your browser's cryptographic randomness) rather than inventing one — humans are predictably unrandom.
3. Make it unique per site. Password reuse is the single most damaging habit: one breached site hands attackers the key to everything else. This matters more than squeezing extra entropy into any single password.
4. Never reuse, never share, never email them. Treat passwords like toothbrushes.
5. Turn on two-factor authentication (2FA) wherever it matters — email, banking, cloud storage. A second factor protects you even if a password leaks.

Use a password manager — seriously

Rules 1–3 are mutually exclusive with human memory: nobody memorizes 100 unique 16-character random strings. That's what password managers are for. A manager generates, stores, and fills strong passwords so you only need to remember one good master passphrase (five random words, per the math above).

Picking one is less fraught than the internet suggests. Any reputable manager with these properties is fine: end-to-end encryption (the company can't see your vault), a published security track record, and export that isn't locked in. Free tiers of the major managers cover the essentials; paid tiers add conveniences, not security. The dangerous option isn't "the wrong manager" — it's no manager, with passwords reused across sites or kept in a notes app.

One practical note: write your master passphrase on paper and store it somewhere safe when you set things up. If you forget it, the encryption that protects you also locks you out — there is no "forgot password" for a properly encrypted vault.

What not to do

• Don't use personal information — names, birthdays, pet names, addresses. Attackers targeting you specifically try these first, and much of it is public.
• Don't follow "clever" patterns — "P@ssw0rd!", "qwerty123", "abc123", seasons+year ("Winter2025!"). Every one is in the attacker's first million guesses.
• Don't trust "password strength meters" blindly. Most meters reward character variety and punish nothing about predictability — "Password1!" scores well on many of them and falls in seconds.
• Don't change passwords on a schedule unless there's a reason (a breach, or you shared it). Forced rotation just produces "Winter2025!" → "Spring2026!" — weaker, not stronger. Change it when there's evidence of compromise.

The 2-minute version

If you take one thing from this guide: install a password manager, let it generate a unique 16+ character password for every site, and protect the manager with a five-word random passphrase plus 2FA on your email. That single setup beats every memorization trick, and it takes less time than reading this article. When you need a password right now, our password generator creates one instantly in your browser — nothing is uploaded or stored.

Frequently asked questions

Generate one now

Ready to put this into practice? Generate a strong password — free, instant, and private. Set your length and character sets, check the entropy readout, and copy it straight into your password manager.