How to create a strong password

The strength of a password comes from how many possibilities an attacker has to try. Each extra character multiplies that number, so a longer password is much stronger than a short one that merely swaps letters for symbols.

Current guidance, including from NIST, favours length and uniqueness over complicated composition rules. A random password of 16 characters is a good default for important accounts.

Entropy, measured in bits, is the length multiplied by the base-2 logarithm of the number of possible characters. A password of 16 characters drawn at random from about 90 symbols has roughly 100 bits of entropy.

Each extra bit doubles the number of guesses needed. Around 80 bits or more is considered very strong for online accounts, and humans rarely reach it with passwords they invent themselves.

People are poor at choosing random text, and attackers know the common patterns: names, dates, keyboard walks and substitutions like @ for a. Use a generator instead of inventing a password.

If you must remember a password, use a passphrase of random words. Four words picked at random from a list of 7,776 give about 52 bits and six words about 77 bits. The words must be chosen randomly, not from a song or a quote.

Use a different password for every account, store them in a reputable password manager and turn on two-factor authentication wherever it is offered. A reused password is only as safe as the weakest site that stores it.

Our password generator creates random passwords in your browser with a cryptographic random generator. Nothing is stored or sent to a server.