Generate strong, random passwords instantly. Customize length and character types.
Use a different password for every account. A password manager like Bitwarden or 1Password makes this easy. Aim for at least 16 characters with a mix of uppercase, lowercase, numbers, and symbols. Never use personal information like your name, birthday, or common words.
Enable two-factor authentication (2FA) wherever possible — it protects your account even if your password is compromised.
Password security is one of the most important aspects of digital safety, yet most people still use passwords that can be cracked within seconds by modern computers. Understanding what makes passwords strong — and what common mistakes to avoid — is essential in an era where data breaches expose billions of credentials every year.
How password cracking works: Attackers use several methods to guess or crack passwords. Dictionary attacks try common words and known passwords from leaked databases. Brute force attacks try every possible combination of characters. With modern GPUs, an 8-character password using only lowercase letters (26^8 combinations) can be cracked in under a second. An 8-character password with uppercase, lowercase, digits, and symbols (95^8) takes about 10 hours. Extend that to 16 characters and it would take millions of years — even with future hardware improvements.
The maths of password strength: Password entropy measures how unpredictable a password is, expressed in bits. Each additional character type exponentially increases the search space: lowercase only gives 26 possibilities per character (4.7 bits); adding uppercase doubles it to 52 (5.7 bits); adding digits gives 62 (5.95 bits); adding symbols gives 95 possibilities per character (6.57 bits). A 16-character fully random password has approximately 105 bits of entropy — considered unbreakable with current technology.
Why you need a unique password for every site: When a website is breached (and breaches are near-constant — over 20 billion credentials were exposed in 2023), attackers acquire your email/password combination and immediately try it on hundreds of other sites in a process called credential stuffing. If you reuse passwords, one breach cascades into many compromised accounts. A password manager solves this by generating and remembering a unique, strong password for every site.
Password managers and why they are essential: A password manager stores all your passwords in an encrypted vault protected by one master password. Top options include Bitwarden (free, open-source), 1Password, and Dashlane. Using a password manager means you only need to memorise one strong passphrase, while every other account gets a cryptographically random password. Most managers also check your stored passwords against known data breaches via secure hash lookups.
Passphrases as an alternative: NIST (the US standards body) recommends long passphrases — random sequences of 4–6 common words — as a human-memorable alternative to complex random passwords. "correct-horse-battery-staple" is 28 characters and has ~44 bits of entropy, making it both memorable and secure. The key word is random: "ilovemydog" is not a secure passphrase because it is guessable, but "marble-fortune-cloud-penguin" is excellent.