How to Make a Strong Password

This guide shows you how to create strong passwords that resist common attacks like brute-force guessing, dictionary attacks, and credential stuffing. You’ll learn a practical method for generating unique, complex passwords for every account, plus how to store them safely. No special tools are required beyond a pen and paper or a password manager.

What You’ll Need

A way to generate random numbers or words (a dice, a random number generator app, or even a deck of cards).
A password manager (recommended) or a secure notebook to store your passwords.
A few minutes of uninterrupted time.

Step-by-Step

Choose a password length of at least 16 characters. Length is the single most important factor. Each extra character multiplies the number of possible combinations exponentially, making brute-force attacks impractical. Aim for 16–20 characters for most accounts, and longer for critical ones like email and banking.
Use a passphrase method for memorability. Pick four or five random, unrelated words. For example: correct horse battery staple (a famous example from xkcd). The key is randomness—not a sentence or a quote. You can make it stronger by adding numbers and symbols, but the core strength comes from the length and unpredictability.
Add complexity deliberately. Insert a number and a symbol somewhere in the middle, not just at the end. For instance, transform correct horse battery staple into correct horse 7! battery staple. Avoid obvious substitutions like @ for a or 0 for o—those are well-known to attackers.
Make it unique for every account. Never reuse a password. If one site gets breached, attackers will try that same password on your other accounts (credential stuffing). Use a different passphrase for each service.
Use a password manager. A password manager can generate and store truly random passwords for each site, so you only need to remember one master password. The master password should be a long passphrase you can recall, while everything else can be a random string like vB9#kL2$mN7@qR5!.
Enable two-factor authentication (2FA) wherever possible. Even a strong password can be phished or stolen. 2FA adds a second layer—a code from an app or a physical key—so a password alone isn’t enough to log in.
Change your password if you suspect compromise. If a service you use announces a data breach, or if you see unusual activity, change that password immediately. Don’t wait for a scheduled rotation.

Common Mistakes

Using personal information. Birthdays, pet names, or your favorite sports team can be guessed from social media or data brokers.
Using common patterns. Sequences like 123456, qwerty, or password are the first things attackers try.
Reusing passwords across sites. One breach can compromise everything.
Changing passwords too frequently. Forcing users to change every 90 days often leads to weaker passwords and slight variations (e.g., Password1!, Password2!). Modern guidance from NIST suggests changing only when there’s a reason.
Writing passwords on sticky notes. If you must write them down, keep them in a locked drawer or a secure notebook, not on your monitor.
Using a password that appears in a dictionary. Even with numbers and symbols, a single dictionary word is weak. Use multiple random words.

Tips

Use a passphrase generator. Many password managers include a passphrase generator that creates random word combinations. This is easier to remember than a random string of characters.
Check your password’s strength. Use a reputable online password strength checker (like the one from zxcvbn) to see how long it would take to crack. Aim for centuries, not years.
Use a separate password for your email. Your email is the key to resetting all other accounts. Make it the strongest and most unique.
Consider a hardware security key. For high-value accounts, a physical key (like a YubiKey) provides the strongest 2FA and resists phishing.
Keep your password manager master password memorable. Use a long passphrase you can type accurately, but don’t reuse it anywhere else.

Troubleshooting

You forgot your password. Use the “Forgot password” link on the login page. You’ll typically receive an email or SMS to reset it. If you use a password manager, you can recover it with your master password.
Your password manager is locked. If you forget your master password, most password managers offer recovery options like a recovery key or a trusted device. If you lose both, you may lose access to all your passwords—so write down your recovery key and store it securely.
A site says your password is too long. Some legacy sites have a 12-character limit. Use the maximum allowed length and make it as random as possible. If the site doesn’t support special characters, rely on length and case variety.
You suspect your password was leaked. Use a service like Have I Been Pwned to check if your email or password appears in known breaches. If it does, change it immediately on any account that uses it.
You’re asked to change your password after a breach. Follow the site’s instructions. If you used the same password elsewhere, change it there too.
You can’t log in because of 2FA issues. If you lose your phone or authenticator app, use the backup codes provided when you set up 2FA. Store these codes in a safe place.

Frequently Asked Questions

What is the ideal password length?

At least 16 characters. Longer is better, but 16–20 is a good balance between security and usability. For critical accounts, aim for 20+.

Are passphrases better than random strings?

Passphrases are easier to remember and can be just as secure if the words are truly random. A 4-word passphrase with 16+ characters is excellent. Random strings are harder to remember but are also strong if long enough.

Should I use a password manager?

Yes, for most people. It allows you to have unique, random passwords for every site without memorizing them. Just ensure your master password is strong and you have a recovery plan.

How often should I change my passwords?

Only when there’s a reason: a breach, a suspected compromise, or if you shared it with someone. Regular forced changes often lead to weaker passwords.

Can I use a pattern like “Password1!”?

No. Attackers know these patterns and will try them. Use a random passphrase instead.

What is a brute-force attack?

It’s when an attacker tries every possible combination of characters until they find the right one. Long, random passwords make this impractical—the time required grows exponentially with each character.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →