How to create a strong password (length beats complexity)
For years we were told a strong password means P@ssw0rd! — a mix of upper, lower, numbers, and symbols. It turns out that advice is mostly wrong. Here's what actually protects your accounts.
Length is the real strength
Every character you add multiplies the number of guesses an attacker needs — exponentially. A long password beats a short-but-complex one every time. A 16-character password made of ordinary words is vastly harder to crack than an 8-character jumble of symbols, and far easier to remember.
A random 8-character password can fall in hours. A 16-character one can take longer than the age of the universe.
Why the "complexity" rules backfired
Forcing symbols and numbers pushed people toward predictable patterns: a capital at the start, a 1 and a ! at the end. Attackers know these habits and build them into their guessing. The complexity was mostly theater; the passwords stayed short and guessable.
What to actually do
- Go long. Aim for 16+ characters. A string of random words (a "passphrase") is both strong and memorable.
- Make it random. The single best password is one you didn't choose — a generated random string has no human pattern to exploit.
- Never reuse. One breached site shouldn't unlock the rest. A unique password per site contains the damage.
- Use a password manager. It generates and remembers long random passwords so you don't have to.
- Turn on two-factor authentication. Even a perfect password is stronger with a second factor.
Generate, don't invent
Humans are bad at being random — we lean on names, dates, and keyboard patterns. A generator produces genuinely unpredictable strings at whatever length you need, and a good one runs entirely in your browser so the password is never transmitted anywhere.