What Actually Makes a Password Strong (It's Not Just Length)

Most password advice boils down to a few rules: make it long, make it random, don't reuse it. These rules aren't arbitrary, each one closes off a specific way attackers actually try to break in, and understanding why helps the advice stick better than just following it blindly.

Length matters because of how brute-force attacks work. An attacker guessing passwords isn't typing them one by one, they're running software that tries combinations extremely fast. Every additional character multiplies the number of possible combinations, not adds to it. Going from an 8-character password to a 12-character one doesn't make it 50% harder to guess, it makes it many orders of magnitude harder, because the possibilities compound with each added character.

Randomness matters because attackers don't only brute-force blindly, they also use dictionaries of common passwords, real words, and predictable patterns like replacing 'a' with '@' or adding '123' at the end. A long password built from a real phrase or predictable substitution is still far more guessable than a long password made of genuinely random characters, because it fits patterns attackers already test for first.

Uniqueness matters for a different reason entirely, it's not about any single password being cracked, it's about what happens when a completely unrelated website you use gets breached. If you reuse a password across sites, a leak from one low-security website can be used to log into your email, banking, or anywhere else you used the same password, a technique called credential stuffing. This is arguably the single biggest real-world cause of account compromise, and it has nothing to do with how strong the password itself was.

Putting this together, a strong password is long (aim for 16+ characters where a site allows it), genuinely random rather than a modified word or phrase, and unique to that one account. Since remembering dozens of long random passwords isn't realistic, this is exactly what a password manager is for, it generates and stores them so you never have to. Our Password Generator lets you create a random password with your choice of length and character types, generated entirely in your browser.