How to Make a Strong Password

Why password strength actually matters

When a website gets breached, attackers don’t sit there guessing your password one at a time. They steal the whole password database and run it through software that tries billions of guesses per second on their own hardware. A short or common password gets cracked in seconds. A long, unique one survives.

The math is brutal: Password123! looks complicated to a human and falls in under a second to a cracker. correct-horse-battery-staple looks goofy and would take centuries.

What makes a password strong

• Length over complexity — every character you add multiplies how long it takes to crack. 16+ characters beats 8 characters with squiggles.
• Unpredictable — not your dog’s name, not your birthday, not on any breach list
• Unique per site — so one breach doesn’t unlock everything else
• Not based on a pattern — Summer2024! and Summer2025! are not different passwords to an attacker

Two ways to actually do this

Option 1: Use a password manager (do this)

A password manager generates a random 20-character password for every site and remembers it for you. You only memorize one master password. See the password manager guide for which one to pick.

This is what security people do. It’s the right answer.

Option 2: The passphrase method (for the one you have to memorize)

You still need one strong password — the master password for your password manager. For that one, use a passphrase:

1. Pick 4-5 random unrelated words: velvet trumpet diesel oyster fence
2. Glue them together however you want: velvet-trumpet-diesel-oyster-fence
3. Optionally swap in a number or symbol: velvet-trumpet-diesel-0yster-fence

It’s long, unique, and you can actually remember it. Don’t use a famous quote or song lyric — those are in cracking dictionaries.

What NOT to do

• Don’t reuse passwords. Ever. One breached site = every account using that password is now exposed.
• Don’t substitute obvious characters. P@ssw0rd! is not a strong password. Crackers check that pattern first.
• Don’t write them on a sticky note under your keyboard. Use a password manager.
• Don’t share them over email or text. Use the password manager’s built-in sharing if you need to.
• Don’t keep using one that was in a breach — check at Have I Been Pwned and our breach checker.

What to do today

1. Sign up for a password manager — Bitwarden is free and good
2. Pick one strong passphrase as your master password
3. Replace your top 5 most important passwords first: email, bank, primary social account, password manager itself, and anything tied to money
4. Turn on two-factor authentication on those same accounts
5. Replace the rest gradually — every time you log into a site, generate a new password for it

The bottom line

Stop trying to invent clever passwords. Humans are bad at it. Let a password manager do it, memorize one good passphrase, and you’ve already done more for your security than 95% of people.