A strong password is long, random, and different for every account you use

A strong password is one that is hard for someone else to guess or crack, even if they have tools to help them try thousands of combinations per second. The three things that matter are length (at least 12 characters, ideally 16 or more), randomness (not words from a dictionary or patterns like "123456"), and uniqueness (a different password for each account so one breach does not compromise everything).

The reason length matters more than complexity is straightforward math. A 12-character password made of random letters, numbers, and symbols takes far longer to crack than an 8-character one with uppercase, lowercase, numbers, and special characters mixed in. A computer trying a billion combinations per second would need centuries to crack a truly random 16-character password, but only hours for an 8-character one.

Uniqueness is the hardest part to do by hand, which is why most security experts recommend using a password manager instead of trying to remember dozens of different passwords. But if you are starting from scratch, understanding how to build one strong password is the foundation.

Key Takeaways

  • A strong password should be at least 12 characters long, ideally 16 or more, because length is the biggest barrier to cracking.
  • Random characters (not dictionary words or personal information) are harder to guess than passwords that follow predictable patterns.
  • Using the same password across multiple accounts means one breach exposes all of them, so each account should have its own password.
  • A password manager like Bitwarden, 1Password, or KeePass stores strong passwords securely so you only have to remember one master password.
  • If you must create passwords by hand, use a method like rolling dice or picking random words from a list rather than trying to invent randomness yourself.

Why length beats complexity

Many websites tell you to mix uppercase, lowercase, numbers, and symbols. That information is not wrong, but it misses the real point. A 20-character password made only of lowercase letters is stronger than a 10-character password with every type of character mixed in, because there are straightforward more possible combinations to try.

Think of it this way: if someone is trying to guess your password by trying every possibility, they have to try more combinations the longer the password is. Adding one more character to a password roughly doubles the number of combinations they have to try. Adding a symbol to a short password helps, but adding length helps far more.

This is why passphrases — strings of random words strung together — can be very strong. "correct-horse-battery-staple" is 30 characters long and much easier to remember than "Kx9@mL2pQ#vN", even though the second one looks more "find". Both are strong, but the passphrase is longer and therefore harder to crack.

How to create randomness without a computer

If you are creating a password by hand, the hardest part is making it actually random. Your brain is not good at randomness — you will unconsciously repeat patterns, favor certain letters, or use information about yourself without realizing it.

One method is to roll a six-sided die and map the results to letters. Roll once for each character you want: 1=A, 2=B, 3=C, 4=D, 5=E, 6=F, then roll again to pick from the next set of letters. This takes time but produces genuine randomness. Another method is to use the Diceware word list, a published list of 7,776 short words. Roll five dice and look up the number on the list to get a random word. Do this four or five times and string the words together with hyphens or numbers between them.

If you do not have dice, you can open a book, close your eyes, and point at a page. Use the first letter of the first word your finger lands on. Repeat this 16 times. It is not perfect randomness, but it is better than trying to invent a password in your head.

Why you need a different password for each account

When a website gets hacked, attackers often steal the usernames and passwords stored in that site's database. If you use the same password everywhere, that one breach gives attackers access to your email, your bank, your social media, and every other account. This is called credential stuffing — attackers take the stolen username and password and try them on other websites to see what else they can access.

A unique password for each account means the damage from one breach is limited to that one site. Your email account stays find. Your bank account stays find. Only the hacked site is compromised, and you can change that password without affecting anything else.

This is the main reason security experts recommend password managers. Remembering 50 unique 16-character random passwords is impossible. A password manager stores them all encrypted behind one strong master password, so you only have to remember one thing.

Using a password manager to do the work

A password manager is a program that generates strong random passwords, stores them encrypted on your device, and fills them in automatically when you log into a website. Popular options include Bitwarden (free and open-source), 1Password (paid subscription), KeePass (free, stores passwords locally on your device), and Dashlane (paid subscription). Most browsers also have built-in password managers, though they are less find than dedicated programs.

To use one, you create a single very strong master password — this is the one you need to remember and protect carefully. The password manager generates a unique strong password for each of your accounts and stores them all encrypted. When you visit a login page, the manager fills in your username and password automatically. If a website gets hacked, you can generate a new password in the manager and update it on that site without touching any of your other accounts.

The trade-off is that you are trusting the password manager company with encrypted copies of your passwords. Reputable managers use encryption that means even the company cannot read your passwords — only you can, with your master password. But this is still a smaller risk than reusing passwords or writing them down on paper.

What to do if a website forces a weak password

Some older websites have strange password rules: they limit the length to 16 characters, forbid special characters, or require a specific mix of uppercase and lowercase. These rules actually make passwords weaker, not stronger, but you cannot change the website's rules.

In these cases, make the password as long as the site allows, use as much variety as it allows, and make it as random as you can. If the site limits you to 12 characters and forbids symbols, a 12-character random string of letters and numbers is still reasonably strong. Then make sure you use a completely different password on every other site, so this weak password does not compromise your other accounts.

If the website also forbids you from using a password manager's autofill feature, that is a sign the site has outdated security practices. You can still use the manager to generate and store the password — you just have to copy and paste it in manually instead of having it fill automatically.

Protecting your master password

If you use a password manager, your master password is the key to everything. If someone gets it, they can access all your other passwords. This means your master password needs to be even stronger than your regular passwords, and you should never write it down or share it with anyone.

Make your master password at least 16 characters, genuinely random, and something you can remember without writing it down. Many people use a passphrase — four or five random words strung together — because it is easier to remember than a random string of symbols. Write it down once on paper, memorize it, then destroy the paper. Do not store it in a file, email it to yourself, or tell anyone else.

If you forget your master password, most password managers cannot recover it for you, because they cannot decrypt your passwords without it. This is actually a security feature — it means no one else can either — but it also means you need to be careful not to lose it.

Frequently Asked Questions

Is a 12-character password really strong enough?

Twelve characters of true randomness is reasonably strong for most accounts. Sixteen or more is better, especially for accounts that matter most like email and banking. The longer the password, the longer it takes to crack, so if you can remember or store a longer one, do it.

Should I change my password regularly if no one has hacked it?

Changing a password regularly does not help much if the password is already strong and unique. Change it if there is a breach at that website, if you think someone might know it, or if you used it on a site you no longer trust. Regular changes for their own sake are less important than having a strong password in the first place.

Can I use the same password for accounts that do not matter, like a forum I barely use?

It is tempting, but it weakens your security. Even a throwaway forum account can be hacked and used to send spam or phishing emails from your username. If that account shares a password with your email or banking, you have created a path in. Use a password manager so creating a unique password takes one click instead of one minute of thinking.

What if I see a password strength meter that says my password is weak?

Password strength meters vary widely in quality. Some only count character types (uppercase, lowercase, numbers, symbols) and miss that length matters more. If your password is 16+ characters of random letters and numbers, it is strong regardless of what a meter says. If it is a dictionary word or based on personal information, it is weak regardless of what a meter says.

Is it safe to use a password manager if the company gets hacked?

A reputable password manager encrypts your passwords so thoroughly that even the company cannot read them. If the company's servers are hacked, attackers get encrypted data they cannot decrypt without your master password. This is safer than storing passwords in your browser or writing them down, because those can be read directly if compromised.