How to Create a Strong Password You Will Actually Use
What makes a password strong, why length beats complexity, and a simple routine for creating and storing unique passwords for every account.
By Daily Desk Tools · · 2 min read
Most password advice boils down to one idea: a password should be hard for a computer to guess and never reused. Here is how to get there without memorizing dozens of random strings.
Length matters more than symbols
Attackers who steal a database of scrambled (hashed) passwords try billions of guesses, starting with common words, names and patterns. Every extra character multiplies the number of possible passwords, so length is the most effective defence.
A 16-character password made of random letters, numbers and symbols is far stronger than an 8-character one with a capital letter and an exclamation mark tacked on the end. Current guidance from standards bodies such as NIST reflects this: it favors longer passwords and screening against known breached passwords over forcing complicated composition rules.
Random beats clever
People are predictable. Swapping "o" for "0" or adding "123" to a word are tricks that password-cracking tools already try. The safest passwords are generated randomly, which is exactly what a password generator does.
Use a different password everywhere
When one website is breached, attackers try the same email and password on other sites. This is called credential stuffing, and it only works if passwords are reused. A unique password for each account stops one breach from turning into many.
Let a password manager remember them
Nobody can remember dozens of random 16-character passwords, and you do not need to. A reputable password manager stores them securely and fills them in for you. You only need to remember one strong master password.
For that master password, a passphrase of several random, unrelated words is both strong and memorable. Choose the words randomly rather than picking a phrase that means something to you.
Turn on two-factor authentication
Even a strong password can be phished. Two-factor authentication (2FA) adds a second step, such as a code from an authenticator app or a hardware security key, so a stolen password alone is not enough to get into your account. Turn it on for email, banking and any account that offers it.
A simple routine
- Open the password generator and set the length to at least 16 characters.
- Generate a password and save it straight into your password manager.
- Use it for one account only.
- Turn on two-factor authentication for that account.
- Change the password if the service tells you it has been involved in a breach.
That is all it takes. Strong, unique passwords stored in a manager, plus two-factor authentication, protect you from the most common ways accounts are taken over.