Most “strong” passwords aren't. What matters isn't really symbols and capital letters — it's length and true randomness. Here is how password strength actually works, and how to make one that resists guessing and brute force.
Generate a strong password free →Length beats complexity
Every extra character multiplies the number of possible passwords, so length does more for security than sprinkling in symbols. A long random password is far harder to crack than a short “complex” one. Aim for at least 16 characters, and more for anything important.
Randomness is everything
A password you invented isn't random — attackers use patterns, common substitutions and leaked wordlists to guess exactly the kind of password people think is clever. The only reliable fix is genuine randomness from a generator that uses your device's cryptographic random source.
What is entropy?
Entropy measures how unpredictable a password is, in bits — and each extra bit doubles the number of possibilities. As a rough guide, around 60 bits is okay, 75+ is strong, and 100+ is very strong. A good generator shows the entropy so you can see the effect of length and character sets.
Common mistakes to avoid
- Reusing the same password across sites — one breach then unlocks many accounts
- Basing it on a name, date or word
- Simple substitutions like P@ssw0rd — cracking tools know them all
- A short password, even a “complex” one
Use a password manager
No one can remember dozens of long random passwords — and you shouldn't try. A password manager generates and stores a unique strong password for every account, so a leak on one site never touches the others. Generate the password, save it, and let the manager fill it in.
Frequently asked questions
Are random passwords safe if I can't remember them?+
Yes — store them in a password manager rather than memorising them. The important rule is never to reuse one password across sites.
Do I need symbols in my password?+
They help, but length matters more. If a site won't accept symbols, add a few more characters to make up for it.
How often should I change my password?+
Only when there's a reason — a breach, or a suspicion it was compromised. Forcing frequent changes tends to make passwords weaker, not stronger.