How to create and check a strong password
Why length beats complexity, how to generate random passwords privately, and what a strength checker can and cannot tell you.
Updated: 3 November 2026
Most people know they should use strong passwords, but few know what “strong” really means. The good news is that the rules are simple, and tools can do the hard part for you. This guide explains what matters and how to check your own passwords.
What makes a password strong
- Length matters most. Every extra character multiplies the number of guesses an attacker needs. Aim for at least 16 characters for important accounts.
- Random beats clever. People are predictable: names, birthdays, years, keyboard runs such as “qwerty” and small changes like “P@ssw0rd” are the first things attackers try.
- Unique for every account. If one site is breached, a reused password lets attackers try it everywhere else.
- Passphrases work too. Several random, unrelated words are long and easier to remember than a string of symbols, but the words must be chosen randomly, not from a favourite quote.
Generate a random password
The Password Generator creates passwords on your device using your browser’s cryptographic random number generator, so every character is equally likely. Choose a length (16 or more is a good default) and the character types the site accepts, and the tool shows an estimate of the strength in bits. Nothing is sent or stored. Copy the result straight into a password manager.
Use a password manager
Nobody can remember dozens of long random passwords, and writing them in a notes file or reusing them is the problem you are trying to avoid. A password manager stores them encrypted and fills them in for you, so you only remember one strong password for the manager itself. Where a site offers two-step verification, switch it on too.
Check a password
The Password Strength Checker estimates how hard a password is to guess and explains why. It starts from the length and character types, then subtracts for the patterns attackers try first: common passwords, keyboard patterns, sequences and dates. It runs locally and shows the specific weaknesses it found, so you can see what to fix.
What a strength checker cannot tell you
Treat the score as a guide, not a guarantee. It is a simplified estimate, and the guessing times it shows are rough. A strong password does not protect you if it was leaked in a breach, if you type it on a phishing site, or if you reuse it elsewhere. As a habit, test a password that is similar to your real one, rather than typing real passwords into any website, even one that says it works offline.
If a password may be exposed
Change it right away, change any other account that uses the same password, and turn on two-step verification. A new random password from the generator is better than adding a number to the old one.