How to Create a Strong Password You Can Remember

Most password advice still sounds like it did twenty years ago: add a capital letter, a number and a symbol. The result is passwords like Summer2024! that feel complex but are among the first ones attackers try. What actually makes a password strong is simpler, and it also makes passwords easier to live with.

What makes a password strong

A password is strong when it is hard to guess, and the honest measure of that is how many possibilities an attacker has to try. Two things decide it: how long the password is and how randomly it was chosen.

Length matters more than anything. Each extra random character multiplies the number of possible passwords. A random 8-character password using letters, digits and symbols has about 52 bits of strength. A random 16-character one has about 104 bits, which is not twice as hard to crack but millions of billions of times harder.

Randomness matters just as much. Attackers do not try every combination in order. They start with leaked password lists, dictionary words, names, dates, keyboard patterns and the usual tricks like replacing a with @ or o with 0. A password that follows a human pattern is weak no matter how long it looks. That is why a generator beats your imagination: it has no patterns.

Official guidance has caught up with this. The US National Institute of Standards and Technology (NIST) recommends favoring length, allowing long passphrases and dropping forced composition rules and routine password changes.

Random password or passphrase?

A random password like 7vQ#mL2x!pR9zT4k is ideal when a password manager remembers it for you. A passphrase like orbit-velvet-candle-harbor is better for the few passwords you need to type or remember yourself: your password manager's master password, your computer login or your phone.

A passphrase is only strong if the words are picked at random, not by you. With a 7,776-word list, each random word adds about 12.9 bits. Four words give roughly 52 bits, six words about 78 bits. Song lyrics, quotes and sentences that make sense are much weaker, because they are predictable.

How to create a strong password with QodeCat

The Password Generator creates passwords in your browser using the Web Crypto API, the same source of randomness browsers use for encryption. Nothing is sent to a server.

1. Open the generator. A new password is created right away, and a meter below it rates it as Weak, Fair, Good or Strong.
2. On the Random Password tab, set the Length slider (6 to 64, default 16) and choose the Character Sets: uppercase, lowercase, numbers and symbols. Turn on Easy to Read under Advanced to leave out look-alike characters such as 1, l, 0 and O.
3. For something you will type, switch to Memorable Passphrase. Choose the Word Count (3 to 10), a separator (hyphen, underscore, dot or space), and optionally Capitalize Words or Include Number for sites that insist on them.
4. Click the refresh button for a new one, then click Copy (or the password itself) to copy it.
5. Paste it into the sign-up form and save it in your password manager straight away.

The Recent History list keeps your last few results while the page is open, in case you copied the wrong one. It is not saved anywhere and disappears when you close the tab.

The strength meter is a quick guide based on length and character variety. As a rule of thumb, aim for at least 16 random characters or 5 to 6 random words for anything important.

Common mistakes

• Reusing a password. When one site leaks, attackers try the same email and password everywhere else. Every account needs its own.
• Predictable substitutions like P@ssw0rd. These are in every cracking dictionary.
• Using personal details: names, birthdays, pets, football clubs or your city.
• Adding 1 or ! at the end to satisfy a rule. Attackers try that first.
• Choosing your own "random" words. People pick common, related words. Let a generator choose.
• Relying on a password alone. Turn on two-factor authentication for email, banking and social accounts.

For a deeper look at two-factor codes, the 2FA Code Generator shows how authenticator apps produce them.

Frequently asked questions

How long should a password be?

For random passwords stored in a password manager, 16 characters or more. For a passphrase you remember, at least 5 random words. If a site limits the length, use the maximum it allows.

Do I need to change my passwords regularly?

Not if they are strong and unique. Change a password when there is a reason: a breach notice, a suspicious login or if you shared it with someone.

Is it safe to generate a password online?

It is when the password is created on your device and never sent anywhere, which is how this generator works. Avoid tools that create passwords on a server.