Create a Strong Password

Strong passwords are the foundation of digital security. This guide walks you through exactly how to create a strong password — and includes a free, in-browser generator so you can create one instantly. No signups, no tracking, no transmission.

What Makes a Password Strong?

A strong password is defined by three core properties: length, complexity, and uniqueness. These three factors determine how well your password resists cracking attempts — from brute-force to dictionary attacks to credential stuffing.

1. Length — The Single Most Important Factor

Every additional character multiplies the number of possible combinations exponentially. A 12-character password has trillions of times more combinations than an 8-character one. Modern security guidance recommends a minimum of 16 characters, with 20+ being strongly preferred for high-value accounts.

2. Complexity — Use All Character Types

Complexity means including all four character classes: uppercase (A–Z), lowercase (a–z), numbers (0–9), and symbols (!@#$%^&* etc.). Each character class adds to the pool of possible characters per position, directly increasing entropy.

• Lowercase only (26 chars): 4.7 bits per character
• + Uppercase (52 chars): 5.7 bits per character
• + Numbers (62 chars): 5.95 bits per character
• + Symbols (94+ chars): 6.6+ bits per character

3. Uniqueness — Never Reuse Passwords

A strong password that you use on multiple sites is no longer strong — if one site is breached, all accounts using that password are compromised. Every account needs its own unique, independently generated strong password.

Step-by-Step: How to Create a Strong Password

1. Set the length to at least 16 characters — use the slider above to set your desired length. 20 characters is the recommended default.
2. Ensure all character types are enabled — uppercase, lowercase, numbers, and symbols should all be active for maximum strength.
3. Click "Generate Strong Password" — the generator uses crypto.getRandomValues(), a cryptographically secure random number generator built into your browser.
4. Copy the password — click "Copy" and paste it directly into your password manager. Never type or transmit your strong password over email, messaging apps, or unencrypted connections.
5. Store it in a password manager — you shouldn't need to memorise strong passwords. A password manager handles secure storage and autofill for you.

What to Avoid When Creating a Strong Password

• ❌ Personal information: Never use names, birthdates, anniversaries, addresses, or pet names.
• ❌ Dictionary words: Even with leetspeak substitutions (p@ssw0rd), dictionary-based attacks will crack them.
• ❌ Keyboard patterns: Sequences like qwerty123 or 1qaz2wsx are the first things crackers try.
• ❌ Repeating characters: Passwords like AAAAbbb123! have far less entropy than truly random strings.
• ❌ Truncated phrases: Simple acronyms from predictable phrases are still guessable with modern AI-assisted cracking.

How Strong Password Standards Compare

Framework	Minimum Requirements
NIST SP 800-63B	Verifier-generated passwords SHALL be at least 8 characters, CSPRNG generated. Recommends 16+.
NCSC (UK)	Recommends machine-generated passwords and password managers over human-created passwords.
OWASP ASVS	V2.1.1: At least 12 characters with complexity. Recommends CSPRNG generation for high-value accounts.
CISA	Strongly recommends 16+ character passwords with full complexity for all enterprise accounts.

Testing Password Strength — What Matters

When evaluating a password's strength, look beyond simple "strength meters." The real metrics are:

• Entropy (bits): A measure of unpredictability. Aim for 80+ bits for general use, 120+ for sensitive accounts.
• Search space: The total number of possible combinations. A 20-character password from 94 characters has ~2.9 × 10³⁸ combinations.
• Time-to-crack: The estimated time for a modern GPU cluster to exhaust the search space. Strong passwords register in "centuries" or "universal age."

Open Full Password Generator →