How to Create a Strong Password You Do Not Have to Remember

Most password advice still says the same thing: one capital letter, one number, one symbol, change it every 90 days. Attackers adapted to those rules long ago, and current guidance from standards bodies like NIST has moved on. What protects you today is simple: long, random, and different for every account.

How passwords actually get cracked

Nobody sits at a login page typing guesses. Websites block that after a few tries. Real attacks look like this:

• Database leaks. A site gets breached and its stored password hashes are copied. Attackers then guess offline, at billions of attempts per second, with no lockout.
• Credential stuffing. Email and password pairs from one leak are tried on banks, email and social media. If you reused the password, they are in.
• Wordlists and patterns. Cracking tools try leaked passwords, dictionary words, names and dates first, with common tricks like P@ssw0rd or Pakistan123! built in.
• Phishing. A fake login page simply asks for it. No password is strong enough to stop this.

A password you made up yourself tends to follow a pattern, and patterns are exactly what cracking tools are built to guess. A truly random password has no pattern to find.

Length beats clever symbols

The strength of a random password is measured in bits of entropy. Each extra bit doubles the number of guesses needed. Length adds bits much faster than a bigger character set does. The table assumes an attacker with stolen hashes making 100,000,000,000 guesses per second, and shows how long an average guess would take for a password generated at random.

Two things stand out. Eight characters is no longer enough, even with symbols. And going from 12 to 16 characters does more than any amount of character swapping. For accounts that matter, use 16 characters or more.

Make one in ten seconds

1. Open the password generator.
2. Set the length to 16 or more.
3. Keep all four character types on, unless a site rejects symbols.
4. Turn on "exclude similar characters" if you will ever type the password by hand, so you do not confuse l, 1 and I.
5. Copy it straight into your password manager or the site's sign-up form.

The generator uses your browser's cryptographic random number generator, the same source used for encryption keys. The passwords are created on your device and never sent anywhere.

You should not remember most of your passwords

If every account has its own random 16-character password, nobody can remember them. That is the point. Store them in a password manager: the one built into your phone or browser, or a dedicated app like Bitwarden or 1Password. It fills them in for you and warns you when a site you use has been breached.

You only need to remember a few: the password for the manager itself, your main email, and perhaps your phone unlock. For those, a passphrase of five or six random words is both strong and memorable. Pick the words at random, for example with dice and a word list, not from a favourite song or quote.

Habits that matter more than the password

• Turn on two-factor authentication for email, banking and social media. An authenticator app is better than SMS, which can be stolen through a SIM swap.
• Never reuse a password. One leak should only ever expose one account.
• Change a password when there is a reason, such as a breach notice, not on a fixed schedule. Forced regular changes push people towards predictable patterns like adding 1, 2, 3 to the end.
• Check whether your email appears in a known breach on haveibeenpwned.com, and change any password used on a breached site.
• Type the address yourself or use a bookmark for your bank, instead of clicking links in SMS or WhatsApp messages.

Quick checklist

• 16 or more random characters for every account.
• A different password everywhere, kept in a password manager.
• A long passphrase for the few you must remember.
• Two-factor authentication on your email and bank.

Ready? Generate a strong password now and replace the one you reuse the most.