How to choose a strong password (and why length beats symbols)

Password strength is not a property of the string, it is a property of how it was chosen. Entropy measures how many equally likely possibilities the attacker must work through, and it depends on your selection process rather than on the characters that came out of it.

That is why 'P@ssw0rd!' looks strong to a naive checker and is worthless in practice: it satisfies every complexity rule while sitting near the top of every cracking dictionary, because the substitutions people make are entirely predictable. Meanwhile four random common words are trivially memorable and astronomically harder to guess.

Each additional random character multiplies the search space; each additional rule usually just tells the attacker which patterns to try first. A modern GPU rig guesses fast-hash passwords at billions of attempts per second, so eight characters is inside reach regardless of how many symbols you sprinkled in. Sixteen or more random characters, or a five-word passphrase, moves the cost beyond anything practical.

• Prefer 16+ characters for anything generated and stored in a manager.
• Prefer 4–6 random words for anything you must type from memory.
• Randomness must come from a generator, not from your imagination — humans are biased.
• Never reuse a password across sites; credential stuffing makes reuse the single biggest real-world risk.

Good meters — the zxcvbn family, which is what this site uses — estimate guessability by pattern-matching against dictionaries, keyboard walks, dates, repeats and leet substitutions, then reporting how long a crack would take at several assumed speeds. That is far more honest than counting character classes.

It still cannot know whether your password already appeared in a breach corpus, whether you used it elsewhere, or whether the site stores it badly. Treat the score as a lower bound on weakness, not a certificate of strength.

Use a password manager and let it generate long random strings you never see. Protect it with a passphrase you have memorised and never typed anywhere else. Turn on two-factor authentication everywhere it is offered, preferring an authenticator app or hardware key over SMS. Rotate only when there is a reason — forced ninety-day rotation reliably produces Spring2026!, then Summer2026!.

Generate secrets in a tool that never transmits them. Our generator uses the browser's crypto.getRandomValues and produces the value locally, so a freshly generated password exists only in your tab and your clipboard.

If you are on the receiving end, the rules are equally short. Hash with a memory-hard algorithm — Argon2id, scrypt or bcrypt — never a bare SHA-256. Use a unique salt per user, which the library handles for you. Impose a generous maximum length rather than a restrictive one, and do not ban characters. Compare hashes in constant time. Rate-limit and lock out on repeated failures, because online guessing is defeated by throttling long before it is defeated by complexity rules.