How to Create a Strong Password: Best Practices for Online Security

What Makes a Password Strong: Length vs. Complexity

For years, the conventional advice was to create passwords with a mix of uppercase letters, lowercase letters, numbers, and special symbols. This advice was well-intentioned but misguided in practice, because it led people to create passwords like "P@ssw0rd!" that look complex to a human but are trivially easy for a computer to guess.

The real measure of password strength is entropy, a concept from information theory that quantifies how unpredictable a password is. Entropy is measured in bits. Each bit of entropy doubles the number of possible passwords an attacker must try. A password with 40 bits of entropy has roughly one trillion possible combinations. A password with 80 bits of entropy has approximately one sextillion combinations.

Here is the key insight: length contributes far more to entropy than complexity. Consider two passwords:

• X7$mK2!q — 8 characters, using the full range of character types. This has approximately 52 bits of entropy.
• correcthorsebatterystaple — 25 characters, using only lowercase letters. This has approximately 66 bits of entropy (when the words are randomly selected).

The longer, simpler password is harder to crack by a factor of about 16,000, and it is far easier for a human to remember. This is why modern security guidance from NIST (National Institute of Standards and Technology) emphasizes length over complexity. Their current recommendations prioritize passwords of 12 characters or more, with 16+ characters being ideal for high-value accounts.

How Attackers Crack Passwords

Understanding how passwords are actually compromised helps you create better ones. Attackers use several methods, and each one exploits a different weakness.

Brute Force Attacks

A brute force attack tries every possible combination of characters until it finds the right one. Modern GPUs can test billions of password hashes per second against common hashing algorithms. An 8-character password using all character types (uppercase, lowercase, digits, symbols) has about 6.6 quadrillion possible combinations. That sounds like a lot, but at a rate of 10 billion guesses per second, it can be cracked in about 7.5 days. A 12-character password with the same character set would take approximately 34,000 years at the same rate. This is why length matters so much.

Dictionary Attacks

Rather than trying every possible combination, dictionary attacks use lists of common words, passwords, and known patterns. Attackers maintain databases of millions of previously leaked passwords and common word combinations. If your password is a single dictionary word, a common name, or a popular phrase, it will be found in seconds. Adding predictable substitutions (@ for a, 0 for o, 3 for e) does not help because attackers include these patterns in their dictionaries.

Credential Stuffing

Credential stuffing does not crack passwords at all. Instead, it uses passwords already stolen from one breached service to try logging into other services. If you used the same password for your email and an online forum, and the forum gets breached, attackers will try that same email and password combination on banking sites, social media, shopping sites, and every other popular service. This is why using a unique password for every account is not optional; it is essential. Credential stuffing attacks are automated and can try millions of stolen credentials against a target service in hours.

Phishing

Phishing attacks trick you into voluntarily entering your password on a fake website that mimics a legitimate one. No matter how strong your password is, phishing can capture it. A convincing email claiming to be from your bank, a fake login page that looks identical to the real one, and a sense of urgency ("Your account has been compromised, log in immediately to verify") are the standard ingredients. The defense against phishing is not a stronger password; it is vigilance, two-factor authentication, and hardware security keys that verify the legitimacy of the website before transmitting credentials.

Social Engineering

Social engineering exploits human psychology rather than technical vulnerabilities. An attacker might call your phone provider, impersonate you using information gathered from social media, and convince a representative to reset your password or transfer your phone number (SIM swapping). Security questions based on personal information (mother's maiden name, first pet, city of birth) are particularly vulnerable because the answers are often publicly available on social media profiles. Use randomly generated answers for security questions and store them in your password manager.

Best Practice 1: Use Passphrases

A passphrase is a password made up of multiple random words. The concept was popularized by the XKCD comic "correct horse battery staple," which demonstrated that a four-word passphrase is both more secure and more memorable than a complex short password.

The strength of a passphrase comes from the number of possible word combinations. If you randomly select from a list of 7,776 words (the size of the standard Diceware list), a four-word passphrase has 7,776 to the fourth power, which is approximately 3.7 trillion possible combinations, or about 51 bits of entropy. A five-word passphrase from the same list has about 64 bits of entropy. A six-word passphrase has about 77 bits.

Important rules for effective passphrases:

• Words must be randomly selected. Do not choose words that form a meaningful phrase, a song lyric, a book quote, or anything else a human would naturally compose. Use a random word generator or roll dice with a Diceware word list.
• Use at least four words. Three random words may be insufficient for high-value accounts. Four words is the minimum recommended; five or six words is better for critical accounts like email and banking.
• Avoid common words and names. A passphrase of "the the the the" or "john smith john smith" has far less entropy than genuinely random selections.
• Consider adding a random number or symbol between words. "correct7horse&battery$staple" adds entropy without significantly reducing memorability.

You can use our password generator to create strong passphrases and random passwords instantly.

Best Practice 2: Use a Password Manager

A password manager is a software application that generates, stores, and auto-fills unique passwords for all of your accounts. You protect the entire vault with one strong master password, and the password manager handles everything else. This solves the fundamental problem that humans cannot memorize 100+ unique, strong passwords.

How Password Managers Work

When you create an account on a new website, the password manager generates a random, unique password (typically 16 to 24 characters with full character variety). It stores this password in an encrypted vault on your device and optionally syncs the encrypted vault to the cloud for access on multiple devices. When you return to the website, the password manager detects the login form and auto-fills your credentials. The vault is encrypted using your master password with strong algorithms like AES-256 and PBKDF2 (or Argon2) key derivation, which means even the password manager company cannot read your stored passwords.

Choosing a Password Manager

Look for these features when selecting a password manager:

• Zero-knowledge architecture. The company should not be able to access your vault, even if compelled by law enforcement. Only you should hold the decryption key (your master password).
• Cross-platform support. Your password manager should work on your computer (Windows, Mac, Linux), phone (iOS, Android), and browser (Chrome, Firefox, Safari, Edge).
• Secure password generation. Built-in generation of random passwords and passphrases with configurable length and character requirements.
• Breach monitoring. Alerts when your stored credentials appear in known data breaches, prompting you to change the affected password.
• Two-factor authentication. The ability to protect your password manager account itself with 2FA, adding a second layer of defense for your vault.
• Emergency access. A way for a trusted person to access your vault in case of emergency (illness, death), typically with a waiting period that lets you deny the request if it is unauthorized.

Popular reputable password managers include Bitwarden (open source, free tier available), 1Password, Dashlane, and KeePass (fully offline, open source). All of these have been independently audited and use strong encryption.

The Master Password Problem

Your password manager is only as secure as your master password. If your master password is weak, the entire vault is vulnerable. Use a strong passphrase of five or more random words for your master password, and never use this passphrase anywhere else. Memorize it; do not write it down in a digital file. If you must create a physical backup, store it in a secure location like a safe deposit box, not on a sticky note on your monitor.

Best Practice 3: Use Unique Passwords for Every Account

Password reuse is the single most dangerous password habit. If you use the same password on five different websites and any one of them is breached, all five accounts are compromised. Data breaches are not rare events; they are a constant reality. Major breaches are disclosed regularly, and countless smaller breaches go unreported.

With a password manager, using a unique password for every account is effortless. The password manager generates and remembers each one. Without a password manager, it is nearly impossible to maintain unique passwords across 100+ accounts, which is exactly why password managers are considered essential security tools by virtually every security professional.

If you are not ready to adopt a password manager, at minimum use unique passwords for your most critical accounts: your primary email (which is the recovery method for most other accounts), your banking and financial accounts, your social media accounts, and any account connected to your phone number (which can be used for SIM swapping attacks).

Best Practice 4: Enable Two-Factor Authentication (2FA)

Two-factor authentication adds a second verification step beyond your password. Even if an attacker steals your password through a data breach, phishing, or any other method, they cannot access your account without the second factor. This single step dramatically reduces your risk of account takeover.

Types of 2FA (Ranked by Security)

1. Hardware security keys (most secure). Physical devices like YubiKey or Google Titan that plug into your USB port or communicate via NFC. They are phishing-resistant because they verify the website's identity before transmitting credentials. This is the gold standard of authentication.
2. Authenticator apps (very secure). Apps like Google Authenticator, Authy, or Microsoft Authenticator generate time-based one-time codes (TOTP) that change every 30 seconds. The codes are generated on your device and never transmitted over the network, making them resistant to interception.
3. Push notifications (secure). Some services send a push notification to your phone asking you to approve or deny a login attempt. This is convenient and reasonably secure, though susceptible to "push fatigue" attacks where an attacker sends repeated prompts hoping you accidentally approve one.
4. SMS codes (least secure of 2FA methods). A text message with a one-time code sent to your phone number. While better than no 2FA, SMS is vulnerable to SIM swapping attacks where an attacker convinces your phone carrier to transfer your number to their device. Use SMS 2FA only when no better option is available.

Enable 2FA on every account that supports it, prioritizing email, banking, social media, and any account that could cause significant damage if compromised. Store backup codes securely in your password manager or a physical safe in case you lose access to your 2FA device.

How Password Generators Work and Why They Matter

Password generators use cryptographically secure random number generators (CSPRNGs) to produce passwords that are truly random. This is fundamentally different from how humans create passwords. Humans are predictably bad at generating randomness. We gravitate toward patterns, meaningful words, dates, and sequences that feel random but are actually highly predictable to a computer.

A CSPRNG uses physical entropy sources (like electrical noise, mouse movements, or hardware random number generators) to produce output that is statistically indistinguishable from true randomness. When a password generator creates a 20-character random password, each character is independently selected with equal probability, meaning there are no patterns, no biases, and no shortcuts an attacker can exploit.

This is why a randomly generated 16-character password is dramatically stronger than a human-chosen 16-character password. The human-chosen password contains patterns and biases that reduce its effective entropy. The generated password does not. Our password generator uses a cryptographically secure random number generator to produce passwords and passphrases with maximum entropy for any given length.

Common Password Mistakes to Avoid

• Using personal information. Your name, birthday, pet's name, spouse's name, street address, and phone number are all publicly discoverable through social media, public records, and data brokers. Never use personal information in passwords.
• Simple substitutions. Replacing "a" with "@", "o" with "0", or "e" with "3" does not meaningfully increase security. Attackers include these substitution patterns in their cracking dictionaries.
• Keyboard patterns. "qwerty," "asdfgh," "zxcvbn," and diagonal patterns like "1qaz2wsx" are among the first things attackers try.
• Incrementing passwords. When forced to change passwords, many people simply change "Password1" to "Password2." Attackers know this pattern and try sequential variations automatically.
• Sharing passwords. Sending passwords via email or text message exposes them to interception and creates a permanent record. If you must share access, use a password manager's secure sharing feature, which encrypts the credential in transit and can be revoked.
• Storing passwords in browsers without a master password. Browser-saved passwords are convenient but may be accessible to anyone with physical access to your device. Use a dedicated password manager or at least protect your browser with a master password.
• Ignoring breach notifications. When a service notifies you of a data breach, change your password on that service immediately, and change it on any other service where you used the same password.

Password Security Checklist

Here is a practical checklist to assess and improve your password security posture:

1. Install a reputable password manager and create a strong master passphrase of 5+ random words.
2. Enable two-factor authentication on your email, banking, and social media accounts using an authenticator app or hardware key.
3. Use the password manager to generate and store a unique, random password (16+ characters) for every account.
4. Check if your email addresses appear in known data breaches (use Have I Been Pwned or your password manager's breach monitoring feature).
5. Change passwords on any accounts that were in a breach or that share a password with a breached account.
6. Replace security question answers with random strings stored in your password manager.
7. Review and close accounts you no longer use, reducing your overall attack surface.
8. Set up account recovery options (backup email, recovery phone) for critical accounts.