How to create strong passwords (and remember them)

What makes a password strong

Strength depends mainly on how many possible combinations an attacker would have to try. That is measured in bits of entropy: each bit doubles the number of guesses. A random 16-character password using upper and lower case, digits and symbols exceeds 100 bits, which is out of reach for brute force.

What weakens a password is not the lack of symbols but predictability: dictionary words, dates, pet names or obvious substitutions such as “P@ssw0rd”. Cracking tools try those patterns first.

Length matters more than complexity

Adding characters increases entropy faster than adding character types. As a practical guide:

• Low-value accounts: at least 12 random characters.
• Email, banking and your password manager: 16 characters or more.
• Passphrases: four or five random words (not a famous quote) are easy to remember and strong.

Never reuse a password

When a service is breached, attackers try the same credentials on other sites. A unique password per service limits the damage to a single account. Nobody can remember dozens of random passwords, and you don't have to: that is what password managers are for.

Password managers and two-factor authentication

A password manager stores all your passwords encrypted and only asks you to remember one master password, which should be long and unique. Also turn on two-step verification (2FA) for important accounts: even if someone gets your password, they will also need your phone or security key.

How to generate one with TodoEnUnClick

The password generator uses the browser's Web Crypto API (crypto.getRandomValues), a cryptographically secure source of randomness. The password is created on your device: it is never sent to a server or recorded in analytics. Choose the length and character types and copy it straight into your manager.