A weak password is the most common reason accounts get hacked. "123456", a birth date, or a pet's name can be guessed in seconds. Let's look at what makes a password strong and how to create one.
What makes a password strong
- Long. Length matters more than complexity: a 16-character password is stronger than an 8-character one, even with special symbols. Aim for at least 12 characters.
- Random. No words, dates, names, or keyboard patterns (qwerty, asdf).
- Varied. A mix of lowercase and uppercase letters, digits, and symbols increases the number of possible combinations.
- Unique. Use a different password for every site. Otherwise, a breach on one service opens the door to all the others.
How to generate a strong password
The simplest way to get a truly random password is to use a password generator. Set the length and character set, and the tool creates a password right in your browser — it is never sent to a server and is not stored anywhere. The strength meter shows you how resistant the password is.
What do "lowercase," "uppercase," and other site requirements mean
Many registration forms require a password with a specific composition, and the wording isn't always clear:
- Uppercase (capital) letter — a letter in upper case: A, B, W, Q. Lowercase — a regular, small letter: a, b, w, q. A requirement for "at least one uppercase letter" means one capital letter somewhere in the password is enough; the rest can be lowercase.
- Digit — 0–9, at least one.
- Special character — a symbol that isn't a letter or digit: !, @, #, $, %, -, _, and similar.
A password combining all four groups (uppercase, lowercase, digits, symbols) is much harder to brute-force than a password of the same length made only of lowercase letters.
Is an 8-character password enough
An 8-character password is the historical minimum, and it's no longer secure enough today: modern hardware can crack such passwords in hours or even minutes if they don't use the full range of character types (uppercase + lowercase + digits + symbols). If a site only allows 8 characters, use all four character groups and avoid words and dates — but for accounts that really matter, choose a service that allows 12+ characters and use the maximum length available.
How to not forget your passwords
If you have many passwords and they're all random, remembering them is simply impossible — and that's fine. Here's what helps:
- A password manager (built into your browser or a standalone app) — stores all your passwords behind a single master password. The most practical option.
- The passphrase method. Come up with a long passphrase made of unrelated words — it's easier to remember than a random string while still being long.
What not to do
- Don't reuse one password across multiple sites.
- Don't store passwords in a plain text file or on a sticky note on your monitor.
- Don't share your password with anyone — support teams never ask for it in full.
A strong password plus a password manager is the foundation of digital security that protects you from most account breaches.