Security
How to Generate Passwords That Are Actually Strong
Most password advice is vague. This covers what makes a password crackable, what doesn't, and how to generate ones that hold up.
Weak passwords are the #1 cause of data breaches. In 2024, over 80% of hacking-related breaches involved stolen or weak credentials.
What Makes a Password Strong?
A strong password should include:
- Length: At least 16 characters (12 minimum)
- Uppercase letters: A-Z
- Lowercase letters: a-z
- Numbers: 0-9
- Symbols: !@#$%^&*()_+-=
- No dictionary words: Avoid common words and phrases
Password Strength by Length
| Length | Characters | Possible Combinations | Time to Crack* |
|---|---|---|---|
| 8 chars | 94 | 6.0 × 10¹⁵ | 5 hours |
| 12 chars | 94 | 4.8 × 10²³ | 34,000 years |
| 16 chars | 94 | 3.9 × 10³¹ | 2.7 × 10¹⁶ years |
| 20 chars | 94 | 3.2 × 10³⁹ | 2.2 × 10²⁴ years |
*Assuming 10 billion guesses per second
Common Password Mistakes
- Using personal info — birthdays, pet names, addresses
- Reusing passwords — one breach compromises all accounts
- Simple substitutions — "P@ssw0rd" is just as weak as "Password"
- Short passwords — anything under 12 characters is risky
- Using patterns — "123456", "qwerty", "abcdef"
Best Practices
- Use a different password for every account
- Use a password manager to store passwords securely
- Enable 2FA (two-factor authentication) on important accounts
- Generate passwords with our tool instead of creating them manually
## What Makes a Password Strong
Password strength depends on four factors:
- Length — Each additional character exponentially increases the number of possible combinations. A 12-character password with mixed character types has roughly 72 trillion combinations. A 16-character password has 7.6 quadrillion.
- Character variety — Using uppercase, lowercase, numbers, and symbols multiplies the keyspace. A 12-character password with only lowercase has 95 quadrillion combinations. Add uppercase, numbers, and symbols, and it jumps to 7.6 sextillion.
- Unpredictability — Random passwords are stronger than human-generated ones because humans tend to follow patterns (capitalizing the first letter, putting numbers at the end, using common substitutions like @ for a).
- Uniqueness — Reusing passwords across sites means one breach compromises all your accounts. A password manager solves this by generating and storing a unique random password for every site.
Password Storage Best Practices
Even a strong password is useless if it is stored in plaintext. Modern systems use one-way hashing algorithms to store passwords:
- bcrypt — Industry standard, includes a salt and allows you to tune the cost factor
- scrypt — Memory-hard, designed to resist GPU and ASIC attacks
- Argon2 — Winner of the Password Hashing Competition, the most modern option
- PBKDF2 — Older but widely supported, still acceptable with high iteration counts
Never use MD5, SHA-1, or SHA-256 for password storage. These are fast hashing algorithms designed for file integrity, not password protection. Their speed makes brute-force attacks feasible.
Common Password Myths
- Myth: Changing passwords regularly improves security. Reality: Frequent forced changes lead to weaker passwords (
Password1!,Password2!). NIST stopped recommending periodic changes in 2017. - Myth: A complex password is stronger than a long one. Reality:
correct-horse-battery-staple(28 chars, no symbols) is stronger thanTr0ub4dor&3(11 chars, mixed). Length beats complexity. - Myth: Password managers are risky because they are single points of failure. Reality: A good password manager with a strong master password and 2FA is far safer than reusing passwords or writing them down.