Create a Strong Password

Strong passwords are the foundation of digital security. This guide walks you through exactly how to create a strong password, and includes a free, in-browser generator so you can create one instantly. No signups, no tracking, no transmission.

What Makes a Password Strong?

A strong password is defined by three core properties: length, complexity, and uniqueness. These three factors determine how well your password resists cracking attempts, from brute-force to dictionary attacks to credential stuffing.

1. Length, The Single Most Important Factor

Every additional character multiplies the number of possible combinations exponentially. A 12-character password has trillions of times more combinations than an 8-character one. Modern security guidance recommends a minimum of 16 characters, with 20+ being strongly preferred for high-value accounts.

2. Complexity, Use All Character Types

Complexity means including all four character classes: uppercase (A–Z), lowercase (a–z), numbers (0–9), and symbols (!@#$%^&* etc.). Each character class adds to the pool of possible characters per position, directly increasing entropy.

• Lowercase only (26 chars): 4.7 bits per character
• + Uppercase (52 chars): 5.7 bits per character
• + Numbers (62 chars): 5.95 bits per character
• + Symbols (94+ chars): 6.6+ bits per character

3. Uniqueness, Never Reuse Passwords

A strong password that you use on multiple sites is no longer strong, if one site is breached, all accounts using that password are compromised. Every account needs its own unique, independently generated strong password.

Step-by-Step: How to Create a Strong Password

1. Set the length to at least 16 characters, use the slider above to set your desired length. 20 characters is the recommended default.
2. Ensure all character types are enabled, uppercase, lowercase, numbers, and symbols should all be active for maximum strength.
3. Click "Generate Strong Password", the generator uses crypto.getRandomValues(), a cryptographically secure random number generator built into your browser.
4. Copy the password, click "Copy" and paste it directly into your password manager. Never type or transmit your strong password over email, messaging apps, or unencrypted connections.
5. Store it in a password manager, you shouldn't need to memorise strong passwords. A password manager handles secure storage and autofill for you.

What to Avoid When Creating a Strong Password

• ❌ Personal information: Never use names, birthdates, anniversaries, addresses, or pet names.
• ❌ Dictionary words: Even with leetspeak substitutions (p@ssw0rd), dictionary-based attacks will crack them.
• ❌ Keyboard patterns: Sequences like qwerty123 or 1qaz2wsx are the first things crackers try.
• ❌ Repeating characters: Passwords like AAAAbbb123! have far less entropy than truly random strings.
• ❌ Truncated phrases: Simple acronyms from predictable phrases are still guessable with modern AI-assisted cracking.

How Strong Password Standards Compare

Framework	Minimum Requirements
NIST SP 800-63B	Verifier-generated passwords SHALL be at least 8 characters, CSPRNG generated. Recommends 16+.
NCSC (UK)	Recommends machine-generated passwords and password managers over human-created passwords.
OWASP ASVS	V2.1.1: At least 12 characters with complexity. Recommends CSPRNG generation for high-value accounts.
CISA	Strongly recommends 16+ character passwords with full complexity for all enterprise accounts.

Testing Password Strength, What Matters

When evaluating a password's strength, look beyond simple "strength meters." The real metrics are:

• Entropy (bits): A measure of unpredictability. Aim for 80+ bits for general use, 120+ for sensitive accounts.
• Search space: The total number of possible combinations. A 20-character password from 94 characters has ~2.9 × 10³⁸ combinations.
• Time-to-crack: The estimated time for a modern GPU cluster to exhaust the search space. Strong passwords register in "centuries" or "universal age."

Open Full Password Generator →