Strong Passwords and Passphrases: What Works and What Does Not

What makes a password strong

A strong password is long, random and unique to one account. Attackers use lists of leaked passwords and fast guessing, so patterns like a name plus a year are weak. Random characters, or random words, resist this. Make one with the Password Generator.

Password or passphrase

A passphrase joins several random words, such as four or more, into one phrase. It is easier to type and remember than random symbols, and length gives it strength. Create one with the Passphrase Generator. The words must be chosen at random. A favorite quote or song line is not random and is easier to guess.

How long should it be

For most accounts, 14 to 16 random characters, or four to five random words, is a strong choice. Use longer for a password manager master password. Strength is shown in bits, and each extra random word adds a fixed amount.

Keep them safe

• Use a different password for every account.
• Store them in a reputable password manager.
• Turn on two step sign in where it is offered.
• Never share a password by message or email.

Our generators run in your browser and do not send your password anywhere.

More guides

• Barcode Types Compared: Code 128, EAN 13 and UPC A

Tools for this guide