Why Strong Passwords Matter, and How to Create One in Seconds

Your email, bank, mobile wallet, social media and business accounts are all protected by the same thing: a short string of characters you chose, often years ago. If that password is weak, or if it is the same one you use somewhere else, everything behind it is only as safe as the weakest website that has ever stored it.

The good news is that fixing this is easy. This guide explains how attackers really guess passwords, what actually makes a password strong, and how to create one in a few seconds with our free Password Generator.

Why a weak password is a real risk

It is tempting to think nobody would bother targeting your account. But most password attacks are not personal. They are automated, run at huge scale, and aimed at everyone at once. A compromised account can be used to:

• Reset your other passwords. Your email inbox is the key to almost every other account, because that is where password-reset links go.
• Steal money or data: payment details, saved cards, invoices, customer lists and private messages.
• Impersonate you to your contacts, customers or colleagues, for example to ask for an "urgent" payment.
• Damage a business: a single staff account with a weak password can be the way into a company's email, website or cloud files.

How attackers actually guess passwords

Very little password cracking happens by typing guesses into a login page. Websites slow that down or lock the account. The real danger comes from three other routes:

1. Data breaches. When a website is breached, attackers often get a copy of its stored passwords. Responsible sites store them as hashes, scrambled values that cannot simply be reversed. But attackers can try billions of guesses per second against those hashes on their own computers, with no lockout. This is called an offline attack.
2. Credential stuffing. Email-and-password pairs leaked from one site are automatically tried on many others. If you reuse a password, one breach anywhere unlocks your accounts everywhere you used it.
3. Smart guessing. Cracking tools do not start with random strings. They start with leaked password lists, dictionary words, names, dates, keyboard patterns like qwerty123, and common tricks such as swapping a for @ or adding ! at the end.

What makes a password strong: length and randomness

Security people measure unpredictability in bits of entropy. Each extra bit doubles the number of guesses an attacker needs. For a password generated truly at random, the entropy is simple to work out: the length multiplied by log₂ of the number of possible characters.

The table below was produced by the strength engine inside our Password Generator. It assumes a fast offline attacker making around 100 billion guesses per second, and gives the tool's rough average time to crack.

Two things stand out:

• Length beats complexity. Sixteen plain lowercase letters (75 bits) are about as strong as twelve characters using every type (76 bits), and far stronger than eight characters using every type (51 bits).
• Eight characters is no longer enough, even with symbols. A fast offline attack gets through all of them in hours.

This matches current official advice. The US National Institute of Standards and Technology (NIST), whose digital identity guidelines are widely followed, now puts length ahead of complexity rules, recommends checking new passwords against lists of known-breached ones, and advises against forcing people to change passwords on a schedule unless there is a sign they have been compromised.

The five habits that matter most

1. Use a different password for every account. This single habit defeats credential stuffing. If one site leaks, only that one account is exposed.
2. Make passwords long and random. Aim for 16 characters or more from a generator, not something you made up.
3. Use a password manager. Nobody can remember dozens of random passwords, and nobody should have to. A password manager stores them securely and fills them in for you, so you only remember one strong master password.
4. Turn on two-factor authentication (2FA) for email, banking and anything important. Even if a password leaks, the attacker still needs your second factor. An authenticator app, security key or passkey is generally stronger than codes sent by SMS.
5. Check whether you have been in a breach. Services such as Have I Been Pwned let you check whether your email address has appeared in a known data breach. If it has, change the password for that site and anywhere you reused it.

How to create a strong password with our free generator

The Password Generator creates passwords on the page itself, in your browser. Nothing you generate is sent to a server, saved, or logged, and reloading the page clears it. Here is how to use it:

1. Open the Password Generator. A 16-character password using all four character types is ready as soon as the page loads.
2. Set the length with the slider or the number box, anywhere from 4 to 128 characters. For important accounts, 16 to 20 is a good choice; longer is better if the site allows it.
3. Choose the character types: uppercase, lowercase, numbers and symbols. Keep all four on unless a website rejects some of them.
4. Optionally exclude look-alike characters (O 0 o I l 1 |) if you might ever need to read or type the password by hand. It costs very little: a 16-character password drops from about 101 to about 100 bits.
5. Read the strength meter. It shows a rating from Very weak to Very strong (with an icon and a word, not just a colour), the entropy in bits, and a rough time-to-crack estimate.
6. Copy it into your password manager or the sign-up form. You can generate a new one with a click, or create up to 100 at once with bulk mode, which is useful when setting up accounts for a team.

Why a generator is safer than making one up

People are bad at being random. We pick words we like, dates that mean something, and patterns that are easy to type, which are exactly what cracking tools try first. The generator uses your browser's cryptographically secure random number generator (the Web Crypto API), never the ordinary Math.random() function used for games and animations. Each character is drawn evenly from the pool, with no bias towards any letter. It also guarantees that every character type you selected actually appears at least once.

What about passphrases?

For the few passwords you must remember and type yourself, such as your password manager's master password or your computer login, a passphrase of several random words can be easier to handle. The key word is *random*: the words must be picked by dice or software from a large word list, not chosen by you.

With a standard list of 7,776 words, each randomly chosen word adds about 12.9 bits. Six random words give roughly 77 bits, similar to a random 12-character password with all four types. A famous quote, song lyric or line from a book is not a passphrase, because it is predictable. Our generator creates character passwords rather than word passphrases, which is ideal for everything you store in a password manager.

Common password myths

• "Swapping letters for symbols makes it strong." P@ssw0rd is one of the first things cracking tools try. Predictable substitutions add very little.
• "I'll just add a number to my usual password." Variations of a reused password are tried automatically once the original leaks.
• "Nobody would target me." Most attacks are automated and indiscriminate. Your account is valuable because of what it can unlock, not because of who you are.
• "Writing passwords down is always wrong." A password manager is better, but a written note kept somewhere physically safe is far less risky than one weak password reused everywhere.
• "A strong password is all I need." Two-factor authentication still matters, because strong passwords can be phished. Before typing a password, check that the address bar shows the real site.

For businesses: a quick checklist

• Give every staff member their own login. Avoid shared passwords for shared accounts wherever the service supports separate users.
• Use a team password manager to share the credentials that must be shared, rather than spreadsheets or chat messages.
• Require two-factor authentication on email, hosting, domain registrar, banking and social media accounts.
• When someone leaves, change every password they knew.
• Make sure your website's login and contact forms are served over HTTPS. Our SSL/TLS Checker can confirm a site answers over HTTPS and look up its certificate history.

The bottom line

Strong passwords are not about clever tricks. They are long, random, and different for every account. Let a generator create them, let a password manager remember them, and turn on two-factor authentication for the accounts that matter most. It takes a few minutes to set up, and it closes the door that most attackers walk through.