How to Create a Strong Password (That You Remember)
A strong password is long and unpredictable — not a puzzle of symbols and substitutions. A passphrase of five random words beats an 8-character tangle like Tr0ub4dor&3, and it is far easier to type and remember. Here is the math behind that claim, a method you can use in five minutes, and the habits that actually keep accounts safe.
What actually makes a password strong?
Strength is not about looks — it is about entropy, unpredictability counted in bits. Every extra bit doubles the guessing work: 52 bits means about 4.5 quadrillion combinations; 53 bits, twice that.
Entropy comes from two things: the pool of symbols per position, and the number of positions:
entropy = length × log₂(pool size)
What does not count is cleverness: a password you invented to “look random”, like P@ssw0rd!, follows patterns cracking software tries first. Entropy only applies when every character was chosen randomly.
How much stronger is long than complex? The math
Take the full set of 94 printable ASCII characters (26 lowercase + 26 uppercase + 10 digits + 32 symbols). Each carries log₂(94) ≈ 6.55 bits, so an 8-character password has:
8 × 6.55 = 52.4 bits → about 6.1 × 10¹⁵ combinations.
Five words drawn at random from a 7,776-word list (the standard Diceware list) give log₂(7776) ≈ 12.92 bits each, so:
5 × 12.92 = 64.6 bits → about 2.9 × 10¹⁹ combinations.
The passphrase has roughly 4,700 times more combinations — and is far easier to type. Each added character multiplies the search space; swapping a letter for a symbol adds less than one bit.
| Password | Entropy | Avg. time to crack* |
|---|---|---|
| 8 random characters (letters, digits, symbols) | 52.4 bits | ~51 minutes |
| 4 random words | 51.7 bits | ~30 minutes |
| 5 random words | 64.6 bits | ~165 days |
| 12 random characters | 78.7 bits | ~7,500 years |
| 6 random words | 77.5 bits | ~3,500 years |
| 16 random characters | 104.9 bits | ~590 billion years |
*Assuming one trillion guesses per second — deliberately generous. Real attacks are slower but smarter (dictionaries, patterns), which is why genuine randomness matters more than the raw number.
Use the passphrase method
Here is the practical method, and it takes about five minutes:
1. Pick 4–5 words at random. Roll dice, flip coins, or use a generator — do not pick words you like. Our Password Generator can produce random passphrases. Five words give about 65 bits of entropy.
2. Join them plainly. Spaces work fine (harbor melon pixel tulip orbit); use a hyphen if a site rejects spaces. Skip leetspeak — it adds almost nothing and hurts typability.
3. Make it memorable with a mental image. Picture the scene the words describe. A vivid, silly image sticks, and the strength comes from the random draw, not from hiding the method.
Never reuse a famous example passphrase (including this one) — well-known phrases live in every attacker’s dictionary. Always generate your own.
Stop memorizing: use a password manager
Memorize one passphrase — the master password for your manager. Everything else gets a unique, 20-character random password you never type; let a password generator create each one and the manager store and fill them.
This kills the two biggest real-world risks at once: reuse and weak-but-memorable passwords. Pick a reputable manager with independent security audits, and protect it with two-factor authentication.
Turn on two-factor authentication
Passwords leak — breaches happen to companies with better security teams than yours. Two-factor authentication (2FA) means a stolen password alone is not enough. An authenticator app or hardware key beats SMS codes (interceptable via SIM swapping), but SMS is still far better than nothing. Enable 2FA on your email first, since email resets can open nearly every other account.
What not to do
- Reuse passwords across sites. Attackers automatically try leaked logins on hundreds of services. One breach becomes all breaches.
- Use personal information. Pet names, birthdays, teams — guessable, and often public on social media.
- Trust common patterns.
Password1!,qwerty123, seasons plus a year — cracking dictionaries contain millions of these. - Rotate passwords on a fixed schedule. Forced 90-day changes were dropped from NIST guidance — they push people toward predictable variations. Change on suspicion or breach notice, not on a calendar.
- Store passwords in plain text. Notes apps and spreadsheets are not vaults. Back up your master passphrase on paper, stored somewhere physically safe.
Practical tips
- Generate, do not invent. We favor certain letters and patterns without realizing it. A generator has no habits.
- Check old passwords against breach lists. Have I Been Pwned shows whether your address or password appears in known leaks. Anything flagged must be replaced immediately.
- Share Wi-Fi without typing. Turn a long Wi-Fi password into a QR code with our QR Code Generator — guests scan instead of you reading out 20 characters.
- Remember: Base64 is encoding, not encryption. Running text through our Base64 Encoder hides it from casual glances, not from attackers. Never treat encoded text as protected.
- Count your passphrase words. Aim for five or more — check with our Word Counter. Each extra word multiplies an attacker’s work by 7,776.
- Back up the master passphrase on paper. A strong passphrase locked away on paper beats a weak one you can recall. Memory fails; paper cannot be phished.
Try it yourself
Generate a strong random password or passphrase in one click — everything runs locally in your browser.
Frequently asked questions
How long should a strong password be?
Aim for at least 16 random characters, or a passphrase of at least five random words. The two approaches are comparable in strength: 16 random characters carry about 105 bits of entropy, while a five-word passphrase carries about 65 bits — both far beyond what any realistic guessing attack can reach. Anything under 12 random characters (or four words) is breakable by a well-funded attacker, so length is the cheapest security you can buy.
Are passphrases really better than complex passwords?
A truly random passphrase beats a short complex password, yes. Five random words give about 65 bits of entropy versus 52 bits for eight random characters — and the passphrase is dramatically easier to type and remember. The catch is the word “random”: picking words you like (“sunshine guitar pizza”) destroys the math. Use dice, coin flips, or a generator to choose the words.
Should I change my passwords regularly?
No — not on a schedule. The U.S. NIST dropped mandatory rotation in its 800-63B guidelines because forced changes push people toward weaker, predictable passwords (“Summer2025!” becomes “Autumn2025!”). Change a password when there is a reason: a breach notification, suspicious activity, or because you shared it. Otherwise, a strong unique password plus two-factor authentication is the better investment.
Is it safe to store passwords in a password manager?
Yes. A reputable, independently audited password manager is far safer than reusing passwords or keeping them in a notes app. You memorize one strong master passphrase, and the manager generates and fills unique random passwords everywhere else. Turn on two-factor authentication for the manager itself, keep an offline backup of the master passphrase, and the residual risk is tiny compared with password reuse.
Can I strengthen an old password by adding “!” or “123” at the end?
No. Attackers know every common trick — capitalizing the first letter, swapping “a” for “@”, appending “!” or a year. These patterns are baked into cracking dictionaries, so “Password1!” falls almost as fast as “password”. If a password follows a guessable pattern, no decoration saves it. Generate a fresh random password or passphrase instead.
What is password entropy?
Entropy measures unpredictability in bits. Each additional bit doubles the guessing work: a 52-bit password has about 4.5 quadrillion combinations, a 53-bit one twice that. It is computed as length × log₂(pool size) — so an 8-character password drawn from 94 symbols has 8 × 6.55 ≈ 52 bits. The catch: entropy only counts when the password was generated randomly. A clever-looking password you invented yourself has far less entropy than the formula suggests.