How to Choose a Strong Password

The advice most people were given is out of date

For twenty years the rules were: mix upper and lower case, add a number and a symbol, change it every 90 days. Those rules produced Summer2024!, then Summer2025!, on every site the person used.

The guidance changed because the old rules optimised for the wrong thing. They made passwords annoying for humans without making them meaningfully harder for a computer to guess.

Three things actually matter, in this order: unique, long, and random.

Uniqueness matters most

If you take one thing from this: a password used on two sites is only as safe as the worse of the two.

Companies get breached. When it happens, the stolen credentials get tried automatically against every other major service — email, banking, shopping. It's called credential stuffing, and it's the single most common way ordinary accounts get taken over. It doesn't care how clever your password is. It only cares that you used it twice.

A unique password per account contains the damage to one account. That's the whole game.

Then length

A random password's strength comes from how many possibilities an attacker has to work through, and that grows exponentially with length. Each extra character multiplies the search space by the size of the alphabet.

Which means adding characters buys you far more than adding weird symbols. Sixteen random characters is comfortably beyond brute force for anything you'll meet. That's why the letters-and-digits option in the generator above is 32 characters rather than 16 — a smaller alphabet is fine if you make it longer.

Length only helps if the password is random. A 20-character password made of dictionary words and a birthday isn't 20 characters of strength; attackers guess in words, not letters.

Then randomness — real randomness

This is where it gets technical, and it's why the generator above is built the way it is.

Browsers have two sources of randomness. Math.random() is fast and predictable — fine for shuffling a playlist, useless for a password, because someone who sees a few outputs can work out what comes next. crypto.getRandomValues() draws from the operating system's cryptographic source, which is designed to be unguessable.

There's a subtler trap too. The obvious way to turn a random byte into a character is to divide by the alphabet size and take the remainder — but if 256 doesn't divide evenly by that size, the earlier characters come up more often than the later ones. The password looks fine and is quietly weaker than its length suggests. The fix is to discard the bytes that would skew it and draw again.

You can't see either of these problems by looking at the output. That's exactly why they're worth knowing about.

Stop rotating on a schedule

Forced 90-day changes are no longer recommended, and haven't been for years.

The reasoning is behavioural. When people are made to change a password regularly, they don't invent a fresh random one — they make the smallest possible edit. Password1 becomes Password2. An attacker who has the old one can guess the new one on the second try.

Change a password when there's a reason: a breach notification, a shared device, a login you don't recognise, or any suspicion at all. Otherwise leave a strong unique password alone.

Two-factor is worth more than a longer password

Once a password is unique and long, the next improvement isn't making it longer still — it's adding a second factor, so a stolen password isn't enough on its own.

Not all second factors are equal:

• Hardware key — strongest, and resistant to phishing
• Authenticator app — very good, and free
• SMS codes — better than nothing, but vulnerable to someone talking your phone company into moving your number

Start with your email account. Almost every other account resets through it, so whoever controls your inbox controls everything else.

You need a password manager

Everything above is impossible to do by hand. Nobody memorises thirty unique random strings, and the coping strategies people invent instead — a pattern, a base word with variations, a notebook by the desk — undo the uniqueness that mattered most.

A password manager makes it a non-decision. It generates them, stores them, and fills them in. You remember one strong passphrase, and that one gets to be memorable because it's the only one you need.

Where people go wrong

• Reusing "just for unimportant sites." The unimportant site is the one that gets breached, and it's often signed up with the same email as the important ones.
• Substituting characters. P@ssw0rd is on every cracking list. Attackers automated that substitution decades ago.
• Personal information. Names, birthdays, pets, teams — all of it is public or guessable.
• Trusting a strength meter. Most measure character variety, not randomness. P@ssw0rd1! scores well and falls in seconds.
• Emailing a password to yourself. Your inbox is the thing you're trying to protect.
• Never checking for breaches. A breach-notification service will tell you which of your accounts have already been exposed, and that's the list to fix first.

The short version

Unique for every account, long rather than clever, generated randomly rather than invented, kept in a password manager, and backed by two-factor on your email before anything else. Change them when there's a reason to, not because a calendar said so.