Most advice about passwords comes down to three things: make it long, make it random, and use it in only one place. Everything else is detail. The trouble is that humans are bad at all three, which is why leaked password lists look so similar from one breach to the next.
In this guide I will explain what makes a password hard to guess, how long it should be, when a passphrase is the better choice, and how to store and protect passwords without losing your mind. If you want the quick route, open the PdfPeaks Password Generator, set the length to 16 or more, and let it do the random part for you. The rest of the article explains why that works and what to do around it.
What actually makes a password strong
A strong password is one that an attacker cannot guess in a reasonable amount of time, even with a powerful computer and a lot of patience. Three qualities decide that.
Length is the first. Every extra character multiplies the number of possible passwords. A password built from the roughly 94 printable keyboard characters gains a little over six and a half bits of strength with each character, so a random 16 character password has about 105 bits and a random 20 character one has about 131. You do not need to follow the math. Just notice that adding four characters is a far bigger jump than adding a symbol.
Unpredictability is the second. Attackers do not try passwords in alphabetical order. They try the most likely ones first: common passwords, names, dates, keyboard runs, and all the usual tricks such as swapping an a for an @. If your password follows a pattern a person could invent, a guessing program can invent it too.
Uniqueness is the third, and the one people skip. When a website is breached, the stolen email and password pairs are tried automatically on other services. A perfect password reused on five sites is only as safe as the weakest of the five.
How long should a password be?
Longer is better, but there is a point where the gains stop mattering for everyday risk. These ranges are a sensible guide for random passwords.
| LengthGood forNotes | ||
| 8 to 11 characters | Nothing important | Short enough that fast guessing attacks can succeed, even when it looks complicated |
| 12 to 15 characters | Low-risk accounts | Acceptable if truly random, weak if built from words or dates |
| 16 to 19 characters | Most accounts | A good default for social media, shopping and streaming |
| 20 to 32 characters | Email, banking, password manager | Strong enough that guessing is not the realistic way in |
| 33 or more | Rarely needed | Some websites will not accept this many, so check the limit |
The 15 character figure is not arbitrary. In August 2025 NIST published the final version of its digital identity guidelines, SP 800-63B Revision 4. For passwords used as the only authenticator, it requires services to enforce a minimum of 15 characters, and it recommends allowing at least 64. NIST wrote this for service providers, but it tells you where the experts have landed: length first.
If a site caps passwords at a small number, use the longest length it allows. A low cap is a warning sign about the site itself, so add two-step verification if it offers it.
Why complexity rules often backfire
Many websites still demand one capital letter, one number and one symbol. People respond predictably. They write a word with a capital at the front, add a 1 at the end and finish with an exclamation mark. Passwords such as Password1! meet the rule and are among the first ones tried.
NIST Revision 4 goes further than earlier versions and says services shall not impose arbitrary composition rules. The reasoning is that these rules make passwords harder for people to remember without making them much harder for attackers to guess.
That does not mean symbols are useless. When a password is generated at random, extra character types make it stronger. The problem is forcing humans to invent them. This is one of the best reasons to let a tool do the choosing. A generated password can include every type of character and still have no pattern in it.
How to create a strong password, step by step
- Decide where it will live. If it will go into a password manager, you never need to remember it, so make it fully random and as long as the site allows. If you will have to type it from memory, such as a master password, plan a passphrase instead.
- Generate it, do not invent it. Open the Password Generator, choose a length of at least 16 characters, keep uppercase, lowercase, numbers and symbols turned on, and generate.
- Match the site's rules without editing by hand. If a site refuses symbols, turn them off and generate again with a longer length. Do not delete characters from a random password to make it fit.
- Use it once. Give each account its own password, starting with the ones that matter most: email, banking, mobile wallets and your phone account.
- Save it immediately. Copy it into a password manager or directly into the account, and do not leave it sitting in a chat window or a screenshot.
- Add a second step. Turn on two-step verification where it is offered, and prefer an authenticator app to SMS codes.
Random password or passphrase?
Both approaches can be strong. They suit different jobs.
A random password is a string of characters with no meaning, such as a mix of letters, numbers and symbols. It packs the most strength into the fewest characters, and it is the right choice for anything saved in a password manager, because you will never type it by hand.
A passphrase is several unrelated words strung together. Its strength comes from the number of words and from picking them truly at random. With a list of 7,776 words, as used by the dice-based Diceware method, each random word adds about 12.9 bits. Five words give roughly 65 bits and six give roughly 78. That is why passphrases are the usual advice for the one password you must remember, such as your manager's master password.
The important word is random. A line from a song, a favourite saying or a phrase you made up yourself is not random, and attackers test quotes and common phrases. Pick the words by dice or with a generator, and do not swap them for words you like better.
Password habits to drop
Some habits show up in almost every leaked password list, so they are worth naming.
Using personal details. Names, birthdays, phone numbers, vehicle numbers and the names of children or pets are the first things an attacker, or someone who knows you, will try.
Keyboard patterns. Strings like qwerty or 123456 are in every guessing list, and so are longer runs along the keyboard.
Predictable substitutions. Writing p@ssw0rd instead of password fools nobody. Guessing programs apply those swaps automatically.
Number-at-the-end updates. Changing Sunrise1 to Sunrise2 when a site demands a new password gives you a different string but no extra safety.
Reusing one password with small changes. If an attacker sees Facebook-Ahmed7 in a leak, they will try Gmail-Ahmed7 next.
Writing it where others can reach it. A sticky note on a monitor in a shared office is a risk. Photos of passwords on a phone are another, because phone galleries are often synced and shared.
Where to keep your passwords
You have too many accounts to memorise a unique password for each, so you need somewhere safe to keep them. A password manager is the best answer. It encrypts your passwords, fills them in for you and can generate new ones. Your browser's built-in manager is a reasonable start, and dedicated apps add features such as secure sharing and breach alerts.
Whichever you choose, protect it with a strong master password and two-step verification. This is the one password worth memorising, and the one place for a passphrase.
What to avoid: saving passwords in WhatsApp chats, in the notes app without a lock, in an email to yourself, or in a spreadsheet called passwords. If you prefer paper, a notebook kept at home is better than reusing one password everywhere, but it does not travel with you and it can be lost.
Turn on two-step verification
A strong password protects you against guessing. It does not protect you if the password is stolen through a fake login page or a leak. Two-step verification covers that gap by requiring something else, such as a code from an authenticator app, before a login succeeds.
Prefer an authenticator app or a hardware key to SMS codes, because phone numbers can be taken over with a SIM swap. Turn it on first for your email, since email resets everything else, then for banking and wallet apps such as JazzCash and Easypaisa, Facebook and Instagram, and Google or Apple accounts. In WhatsApp, enable two-step verification and set the PIN, which stops someone from registering your number on another phone.
Wi-Fi and router passwords
Your Wi-Fi password and your router's admin password are two different things, and both need attention.
The Wi-Fi password lets people join your network. For WPA2 it can be 8 to 63 characters, so use a long random one or a passphrase of 16 or more characters. Avoid phone numbers, house numbers and anything on the router label.
The admin password protects the router's settings page. If it is still the default, anyone on your network can open the page and change your settings. Replace it with a strong, unique password and save it in your manager.
If your router has a guest network, give visitors that one so your main Wi-Fi password stays private.
What to do if a password leaks
If a service announces a breach, or you find your email address on a leak-checking site such as Have I Been Pwned, act the same day. Change the password for that account first. Then change it on every other account that used the same one. Generate a new random password for each, turn on two-step verification, and look at the account's recent activity for anything you do not recognise.
If the leaked password was your email password, treat it as the urgent one. Anyone with access to your email can reset the others.
Weak and strong passwords side by side
Looking at patterns is more useful than looking at examples, so here are the differences without publishing any real password.
A weak password is short, built from words or details about you, and often follows a recipe: a name, a capital letter at the front, a year or a number, and a symbol at the end. It is easy to remember because it follows rules your brain likes, and for the same reason a guessing program finds it quickly.
A reasonable password is long and built from several unrelated words or a long phrase, but it still came from your head. It is better than the first kind, though it can share habits with passwords other people choose.
A strong password is long, has no meaning, and was picked by a random process rather than by you. It looks unmemorable, and that is the point. You do not need to read it, remember it or type it. You copy it into your manager once and let the manager fill it in from then on.
If you are unsure where a password falls, ask whether you could explain how you made it. If you can describe the recipe, an attacker can try the recipe.
Shared accounts and family logins
Some passwords have to be shared, such as a streaming plan, a shop's social media page or a parent's account that you help manage. This is where good habits usually fall apart.
Give each shared account its own strong password and never reuse the one from your email. Do not send passwords in a group chat, where they sit in the history for anyone who joins later. If your password manager has a sharing feature, use it. If it does not, share the password in person or by phone, and change it when someone leaves the group.
For an older relative who is not comfortable with managers, set up the account together, generate a long random password, and write it in a notebook kept at home. Then switch on two-step verification using a number they trust. That is far safer than the same short password they have used for ten years.
In a small business, avoid one login shared by the whole team. Create separate accounts so you can remove one person without changing everyone's password.
Should you trust the password your browser suggests?
Chrome, Safari, Edge and Firefox can all suggest a strong random password when you create an account, and they will save it for you. For most people that is a big improvement over inventing one.
The suggestions are random, so they are fine to accept. The question is what happens to them afterwards. A browser manager is convenient and tied to your device or account, so protect that account with a strong password and two-step verification, and lock your phone and computer. If you use several browsers or devices, or you want to share logins safely, a dedicated manager gives you more control.
A standalone generator is useful in the places a browser does not reach, such as a router setting, an app that does not offer suggestions, or a password you are about to hand to a colleague. Use whichever tool is in front of you, as long as the password ends up random, long and stored somewhere safe.
No comments yet. Start the discussion.