How to Create a Strong Password
Weak passwords are still the single biggest cause of account takeovers. This guide explains what actually makes a password strong in 2026, why length beats complexity, and how to build a system you can live with.
What actually makes a password strong
A strong password is one that would take a modern attacker an unreasonable amount of time to guess, even if they have leaked hashes and specialised cracking hardware.
Two factors matter most: length and unpredictability. Each extra character multiplies the number of possible combinations, while unpredictability makes wordlist attacks useless.
- Length: aim for at least 16 characters for important accounts.
- Character variety: mix upper and lowercase letters, digits, and symbols.
- Uniqueness: never reuse the same password across two sites.
- Unpredictability: avoid names, dates, favourite teams, or dictionary words.
Why length beats complexity
A 12-character password with symbols is weaker than a 20-character passphrase of random words. Each additional character exponentially expands the search space that attackers must brute-force.
This is why security researchers now recommend passphrases of four or more random words for humans, and long random strings for anything a password manager remembers.
Common mistakes to avoid
Attackers rarely guess your password character-by-character. Instead, they run leaked password lists, dictionary combinations, and known patterns. Anything predictable falls in seconds.
- Using birthdays, pet names, or postal codes.
- Simple substitutions like 'p@ssw0rd' — cracking tools try these first.
- Reusing a 'base' password with small variations per site.
- Writing passwords in plain text files or unlocked notes apps.
Use a password manager
The most effective habit you can build is delegating password memory to a reputable password manager. You memorise one strong master password, and the manager generates and stores unique random passwords for every account.
Well-known options include 1Password, Bitwarden, Dashlane, and the managers built into modern browsers and operating systems.
Generate passwords safely
When you need a strong random password quickly, use a generator that runs locally in your browser so the password never touches a server.
ToolFerry's Password Generator does exactly that — it uses the browser's cryptographic random API and never transmits generated passwords.