How to Create a Strong Password: A Practical Guide

Why most passwords people create are weak

When people create passwords on their own, they follow predictable patterns. A word they know, a number that means something to them (a birth year, a memorable date), and sometimes a symbol tacked on at the end. Attackers know this. Password cracking software doesn't try random guesses — it works through lists of common words, common substitutions, and common patterns, in order of likelihood.

The result is that a password like "Mike1987!" takes seconds to crack, not because computers are fast (though they are), but because that password sits near the top of every attack wordlist ever compiled.

What actually makes a password secure

Security researchers and institutions like NIST (National Institute of Standards and Technology) have moved away from complexity rules and toward two simpler principles:

• Length matters more than anything else. A 20-character password made of random lowercase letters is stronger than a 10-character password with uppercase, numbers, and symbols. Every character you add multiplies the number of possible combinations exponentially.
• Uniqueness per account is non-negotiable. When a company gets breached, attackers take the stolen credentials and try them on every major platform. A reused password means one breach becomes a dozen.

The case for random passwords over memorable ones

There's a school of thought that recommends "passphrases" — long strings of random words like "correct horse battery staple." These are genuinely better than short complex passwords. But they have a ceiling: because they're made of real words, they're more vulnerable to dictionary attacks than truly random strings of the same length.

For accounts you care about, a random 20-character string stored in a password manager is better than any phrase you can memorize. The goal isn't to remember the password. The goal is to have a password that cannot be guessed.

How password managers change everything

The reason most people reuse passwords is that they can't remember dozens of unique ones. Password managers solve this completely. You remember one strong master password. The manager remembers everything else, generates random passwords for new accounts, and fills them in automatically.

Bitwarden is free and open source. 1Password and Dashlane are paid with more features. Any of them is infinitely better than reusing passwords or keeping a list in a notes app.

When to change a password

The old advice of changing passwords every 90 days has been largely abandoned by security professionals. Forced rotation leads people to make predictable changes (adding a "1" to the end, capitalizing the first letter) that don't actually improve security.

Change a password when there's a reason to: a known breach of a service you use, suspicion that someone has accessed your account, or when you've shared a password with someone who no longer needs access. Not on a schedule.

Two-factor authentication: the layer that matters more than password strength

Even a weak password becomes very difficult to exploit if two-factor authentication (2FA) is enabled. 2FA requires a second piece of information — a code from an app, a fingerprint, a hardware key — in addition to your password. An attacker who has your password still can't log in without the second factor.

Enable 2FA on your email, your bank, your password manager, and any social media account with a significant following. Use an authenticator app like Google Authenticator or Authy rather than SMS codes when the option exists, as SMS can be intercepted.

How to generate a strong password without thinking about it

The fastest approach is to use a generator that creates truly random strings, not one that picks from a list of "secure-looking" words. True randomness means no pattern, no dictionary words, no predictable structure.

PerfectName's password generator runs entirely in your browser using the Web Crypto API — the same cryptographic standard used by banks and governments. Nothing you generate is sent to any server. The result is immediately available to copy into your password manager.