What Makes a Password Strong?

Strength is unpredictability

A password's strength is how many guesses an attacker must make to find it. That is measured in entropy (bits). Symbols help a little; length and randomness help a lot.

Test yours with the password strength checker.

Entropy in one picture

Adding characters multiplies the search space; swapping letters for symbols barely moves it.

The rules that actually work

1. Use 14+ characters — or a 4–5 word passphrase.
2. Make it random — do not build it from personal facts.
3. Unique per site — never reuse.
4. Use a password manager — it removes the memory problem.
5. Turn on two-factor authentication (2FA) — the single biggest win.

Generate strong ones with the password generator.

Why reuse is the real danger

When one site is breached, attackers try the same email/password everywhere ("credential stuffing"). One reused password can unlock your email, banking and social accounts. Unique passwords break that chain.

Passphrases: strong and memorable

Random words are strong because the number of word combinations is enormous:

copper-lantern-orbit-mango

For a human, this is easier to remember than x7#Qp!2 and far stronger.

What to avoid

• Personal details: names, birthdays, pet names.
• Patterns: qwerty, 123456, abcdef.
• Single dictionary words and common substitutions (p@ssw0rd).
• Reusing a password across accounts.
• Sharing passwords over chat or email.

Beyond the password

• 2FA / MFA — codes or hardware keys.
• Passkeys — phishing-resistant, increasingly available.
• Breach monitoring — change passwords for any account in a leak.

Check and improve

Measure any password's strength with the strength checker and generate replacements with the generator — all computed locally in your browser.