How to Create a Strong Password (and Keep It Safe)

Most stolen accounts weren't cracked by clever guessing. They fell to reused passwords, short passwords and passwords that were already sitting in leaked lists. Fixing that takes only a few habits.

Length matters most

Each extra character multiplies the number of possibilities an attacker has to try. A random 16-character password using letters, digits and symbols has around 100 bits of strength, which is far beyond what any attacker can guess. A common word with a number on the end doesn't come close.

• Use at least 16 characters for important accounts, and more for your email and password manager.
• Make it random. People are bad at randomness, so let a generator do it.
• Don't build passwords from names, dates or keyboard patterns like "qwerty123".

Passphrases

A passphrase is several unrelated words, such as "copper-lantern-tulip-orbit-fable". Five or six random words are long enough to be strong and much easier to type and remember. Use it for the few passwords you must memorize, like your password manager.

One password per site

When one website is breached, attackers try the same email and password on other sites. A unique password for every account stops one leak from becoming many.

Use a password manager

You can't remember dozens of random passwords, and you don't have to. A password manager stores them and fills them in. Protect it with one strong passphrase.

Turn on two-factor authentication

A second step, such as an authenticator app or a security key, means a stolen password alone isn't enough to get in.

For developers: how to store passwords

• Never store passwords as plain text, and never encrypt them so they can be decrypted.
• Hash them with a slow, salted algorithm built for passwords: bcrypt, scrypt or Argon2.
• Don't use fast hashes like MD5 or SHA-256 on their own. They are designed to be quick, which helps attackers guess billions of passwords per second.

Generate a strong random password with the Password Generator. Everything is created in your browser and nothing is sent anywhere.