How to create strong passwords (and why passphrases win)

Most password advice is stuck in 2005. The truth is simpler than the old "8 characters with a symbol" rule: length beats complexity, and a passphrase you can remember is stronger than a short scramble you can't.

What actually makes a password hard to crack

Attackers don't sit and type guesses. They run billions of attempts per second against leaked password databases. The only thing that reliably defeats that is entropy — the number of possible combinations your password could be. More entropy means exponentially more time to brute-force.

Entropy grows two ways: a bigger character set, and — far more powerfully — more length. Adding one symbol multiplies the guesses a little. Adding a whole extra word multiplies them enormously. That's why a 20-character phrase of ordinary words beats a gnarly 9-character scramble.

A random 8-character password can fall in hours. A four-word passphrase can take centuries at the same guess rate.

Why passphrases win

A passphrase is several random words strung together — for example copper-lantern-meadow-42. Compare the two approaches:

• Short scramble (T7!q9zK) — high entropy per character, but so short that the total is modest, and impossible to remember, so you reuse it or write it down.
• Passphrase (copper-lantern-meadow-42) — huge total entropy from length, and genuinely memorable, so you don't reuse it.

The security world converged on passphrases for a reason: the weakest part of any password system is the human. A scheme people can actually follow beats a "perfect" one they route around.

The rules that still matter

1. Length first. Aim for at least 12 characters, ideally 16+. If it's a phrase, four or more words.
2. Never reuse. One leaked site shouldn't hand attackers the keys to your email and bank. Reuse is the single biggest real-world risk.
3. Avoid the obvious. No names, birthdays, password1, keyboard walks (qwerty), or single dictionary words. Crackers try these first.
4. Turn on two-factor authentication. Even a strong password is stronger with a second factor. It's the highest-value five minutes in security.

How to remember dozens of them

You shouldn't try. Use a password manager to generate and store a unique long password for every site, and protect the manager itself with one strong passphrase plus 2FA. That's the whole system: one phrase in your head, everything else in the vault.

If you'd rather generate passphrases yourself, our Passphrase Generator builds memorable, high-entropy phrases using a cryptographically secure random source — right in your browser, never transmitted. Pair it with the strength checker to see exactly how much protection each option buys you.

A quick myth to drop

Forcing a password change every 90 days makes security worse, not better — people just increment a number (Spring2025 → Spring2026). Modern guidance from security bodies is to change a password only when you have a reason to believe it's compromised. Spend that effort on length and uniqueness instead.