Most people's passwords fall into one of two categories: so simple they're easy to crack, or so complex they're written on a sticky note under the keyboard.
There's a better way.
What Makes a Password Strong?
A strong password has three properties:
- Length — at least 16 characters. Every extra character multiplies the time it takes to brute-force it exponentially.
- Randomness — no dictionary words, names, or keyboard patterns like
qwerty123. - Uniqueness — a different password for every account. If one site gets breached, the others stay safe.
A password like correcthorsebatterystaple is memorable but still weak by modern standards because it uses real words. A randomly generated string like xK#9mP2$vL7nQ4wR is far stronger — but impossible to memorize.
How to Generate One
Use the Password Generator on this site. It creates cryptographically random passwords directly in your browser — nothing is sent to a server.
Recommended settings:
- Length: 16–20 characters
- Include: uppercase, lowercase, numbers, symbols
- Exclude ambiguous characters if you ever need to type it manually (avoids confusing
0andO,land1)
The Real Problem: What Do You Do With It?
Here's where most people give up. A 20-character random password is uncrackable but also untypeable from memory. The solution isn't to make it simpler — it's to stop memorizing passwords altogether.
A password manager stores every password in an encrypted vault. You remember one strong master password; it remembers everything else. When you log into a site, it autofills the credentials.
1Password is the most trusted option. It works across every device and browser, generates passwords for you, and alerts you when any of your saved passwords appear in a data breach.
After generating your password above, store it in 1Password before you use it anywhere.
How Long Would It Take to Crack Yours?
A 12-character random password with mixed characters takes an estimated centuries to brute-force with current hardware. A 16-character one pushes that to billions of years.
By contrast, password123 is cracked in under a second.
The math is entirely on your side — as long as you use a generator instead of making something up.
Quick Checklist
- [ ] Generated a random password of 16+ characters
- [ ] Enabled uppercase, lowercase, numbers, and symbols
- [ ] Saved it in a password manager before using it
- [ ] Using a different password on every account
If you check all four boxes, your accounts are more secure than 95% of internet users.