Everyone knows their passwords should be “stronger,” but most advice points at the wrong thing. It tells you to add a capital letter, a number, and a symbol — and then you end up with Password1!, which an attacker's software guesses in seconds. The single thing that actually makes a password hard to crack is simpler than that, and once you understand it, the rest falls into place.
Length beats complexity
Cracking a password means guessing, and the number of guesses required grows explosively with length. Every extra character multiplies the possibilities, far more than swapping a letter for a symbol does. A long password built from ordinary characters is dramatically harder to crack than a short one bristling with punctuation. This is why the classic tricks — turning E into 3, adding a ! at the end — barely help: attackers build those exact substitutions into their guessing software, so P@ssw0rd is treated as no stronger than password.
So the first rule is just: make it long. A genuinely random string, or a passphrase of several unrelated words, gives you the length that actually matters.
The rule that matters more than any single password
Here's the part most people miss. Even a perfect password becomes a liability the moment you reuse it. When any one website gets breached — and they do, constantly — attackers take the leaked passwords and try them on every other service they can find. Reuse turns one company's breach into a break-in on your email, your bank, everything. So the most important habit isn't any single strong password; it's a different password for every account.
Nobody can remember dozens of long random strings, which is exactly what a password manager is for. It generates and stores a unique strong password for each account, and you only ever remember one master password. It's the single biggest upgrade most people can make to their security.
How to make a strong one right now
- Open the Password Generator and set a good length — longer is stronger.
- Generate it, and use it for exactly one account.
- Save it in a password manager rather than trying to memorise it, and turn on two-factor authentication where the account offers it — that protects you even if the password ever leaks.
The generator runs entirely in your browser. A password that's sent to someone else's server to be “generated” is a password you can't trust — here, nothing you create ever leaves your device.