What Makes a Password Secure? A Practical Guide

Weak passwords are one of the most common causes of account compromises. Understanding what makes a password strong — and how to create one — takes only a few minutes but pays off indefinitely.

The Four Pillars of a Strong Password

• Length: Each additional character multiplies the number of possibilities an attacker must try. Aim for 16 characters or more.
• Randomness: Avoid dictionary words, names, and predictable patterns. True randomness is best achieved with a generator, not human memory.
• Character variety: Mix uppercase letters, lowercase letters, digits, and special characters to expand the character set.
• Uniqueness: Never reuse a password across accounts. A breach on one site would expose all accounts that share it.

Password Entropy in Plain Terms

Entropy measures how unpredictable a password is. A password using only lowercase letters (26 options per character) at 8 characters has about 38 bits of entropy. Add uppercase, digits, and symbols (roughly 94 options per character) and stretch to 16 characters, and entropy exceeds 100 bits — well beyond what brute-force attacks can reach in any reasonable time.

How to Generate a Secure Password

1. Open the Password Generator tool.
2. Set the length to 16 or more characters.
3. Enable all character types: uppercase, lowercase, numbers, and symbols.
4. Click Generate to create a cryptographically random password.
5. Copy it immediately and save it in your password manager.

Common Password Mistakes

• Using personal information: birthdays, names, and pet names are the first things attackers try.
• Simple character substitutions: replacing "a" with "@" or "e" with "3" is well-known to attackers and adds almost no security.
• Short passwords: an 8-character password is crackable in hours with modern hardware; 12 characters raises that to years.
• Reusing passwords: a credential stuffing attack takes a leaked email/password pair and tests it automatically across hundreds of sites.

Two-Factor Authentication

Even the strongest password can be phished. Enable two-factor authentication (2FA) on every account that supports it. Authenticator apps (Google Authenticator, Authy) are more secure than SMS-based codes, which are vulnerable to SIM-swapping attacks.