How Do You Actually Create a Strong Password?

Practical advice on length, randomness, and using a password manager.

Summary

Trying to make a strong password memorable usually backfires. Length matters more than complexity, and storing a long, randomly generated password in a password manager is safer than trying to memorize it.

Step by step

Generate a password at least 16 characters long.
Mix letters, numbers, and symbols randomly.
Use a different password for every account.
Save your passwords in a password manager.

Why it matters

Most account takeovers don't involve anyone guessing your password. The more common route goes like this: a site you once signed up for gets breached, your email and password end up on a list, and attackers automatically try that same pair on other services. If you reuse passwords, a leak from some forum you've forgotten about can open up your email or banking app. A unique password per account breaks that chain.

The one password you do need to remember

With a password manager, you only have to memorize a master password. A passphrase of four or five randomly chosen words works well here. Unrelated words are longer and easier to remember than a short string packed with symbols. Let a generator pick the words rather than choosing them yourself, because people drift toward meaningful, guessable combinations. Don't use the master password anywhere else.

Common mistakes

Using one base password with small tweaks per site, like adding the site's first letter at the end. That pattern is easy to crack.
Building passwords from things findable on social media: birthdays, team names, pets.
Keeping passwords in a plain text note or an unsent email draft.
Treating two-factor authentication as something only weak passwords need. It does its best work alongside a strong one.

A worked scenario

Someone at an accounting firm has used the same password for years on work email, personal email and a few shopping sites. When one of those shops announces a breach, he sets aside a weekend. He installs a password manager and changes his email passwords first, since every other account's reset links go there. Then come banking and work accounts, and finally the sites he rarely uses. For each one he generates a new long password and turns on two-factor authentication wherever it's offered.

When should you change a password?

There's no need to rotate a strong, unique password on a schedule. Change it when a service you use reports a breach, when you've shared it with someone, or when you notice a sign-in you don't recognize.