How to create a strong password

Every character you add multiplies the number of possibilities an attacker has to work through, so length is the one factor that scales in your favour. A 20-character passphrase of ordinary words is dramatically harder to crack than an 8-character string of symbols, and it is far easier to type on a phone.

The old advice — one uppercase, one number, one symbol, eight characters — was designed around 1990s hardware and human patterns that are now completely predictable. It produces passwords that are hard for people and easy for machines, which is exactly backwards.

Replacing a with @, e with 3, o with 0, and adding ! at the end does not meaningfully help. Cracking tools apply every one of those rules automatically, because everyone was taught the same tricks. P@ssw0rd! is not a strong password; it is a dictionary word plus four transformations a tool tries in the first second.

Pick four or five unrelated words and join them: copper-lantern-mango-drift. Unrelated is the important part — a phrase from a song or a film is in the wordlists that get tried first.

Add a number or symbol somewhere in the middle if a site demands it, not on the end where every tool looks. Make it long enough that you are typing at least 16 characters.

You can check any candidate in our password strength checker and see the maths behind it in the entropy calculator. Both run entirely in your browser — nothing you type is sent anywhere, which you can verify in your browser's network tab.

A perfect password used on five sites is only as safe as the weakest of those five. When one is breached, attackers immediately try the same email and password everywhere else, and that automated replay — credential stuffing — is behind a large share of account takeovers. Uniqueness protects you more than complexity does.

Nobody remembers thirty unique 16-character passwords, and every system built on remembering them collapses into reuse. A password manager (Bitwarden, 1Password, or the one built into your browser) generates and stores them, so you memorise exactly one strong passphrase and let it handle the rest. Protect that master password with 2FA and save its recovery kit somewhere safe.

Make your email password the strongest one you have, because it resets everything else. Then banking and payment accounts. Then the rest, ideally generated rather than invented. And turn on two-factor authentication as you go: a strong unique password plus a second factor is the point at which ordinary attacks stop working on you.