How to create a strong password
The three things that really make a password strong: length, randomness and a different password for every account. Why passphrases and password managers help.
SecurityThe Passhield team2 minute read
We all know the rule "at least one capital letter, one digit and one symbol". Yet it often leads to passwords like Company2025!: it follows the rule, and it is exactly the pattern attackers try first. Three things really make a password strong.
1. Length
A password's strength is the number of guesses needed to find it. Every extra character multiplies that number. That is why length adds more strength than complexity: a random 20-character password is many times stronger than an 8-character "complex" one.
Current guidance (for example the US NIST SP 800-63B) also puts length ahead of composition rules and advises against forced periodic changes.
2. Real randomness
People are bad at choosing randomly. We add numbers to words, swap letters for look-alike symbols (@ for a) and put an exclamation mark at the end. The tools attackers use know these transformations and try them first.
For real randomness, make passwords with a generator. Our free password generator runs in your browser with a cryptographic random number generator.
3. A different password for every account
Even the strongest password weakens when it is used on two accounts. When one site is breached, attackers try the same e-mail and password elsewhere. This is called credential stuffing and is one of the most common attacks.
For what you must remember: a passphrase
A long, random, different password for every account is not something anyone can memorise. The only thing you should have to remember is your password manager's master password, and a passphrase is a good way to make it: five or six randomly chosen words (such as Willow-Lantern-Pretzel-Compass-Harbor-7) are both strong and memorable. The words must be chosen at random; a meaningful sentence or a song lyric can be guessed.
Why a password manager helps
A password manager creates a long, random password for every account, keeps it and fills it on the sign-in page. You remember only your master password. For teams it also manages who passwords are shared with and who saw them.
Curious how strong an existing password is? Try the password strength checker, with one built the same way rather than your real password.
In short
Long, random and different for every account. Leave that to a password manager rather than doing it by hand, and use a passphrase for the one thing you must remember.