Random, not memorable.

Generating a password that is actually strong

Password strength is almost entirely about length. A 20-character password of ordinary words is stronger than an 8-character password of random symbols, and it is easier to type.

1. Set a length. Sixteen characters is a good default and comfortably beyond what current hardware can brute force. Twenty or more if the site allows it, which most do.
2. Choose a character set. All four classes — lowercase, uppercase, digits and symbols — gives the largest space per character. Some systems reject symbols, so the toggles exist.
3. Generate. The password is produced by the browser’s cryptographic random number generator, not by a predictable formula, and it is never transmitted.
4. Store it somewhere real. A password manager, not memory and not a notes app. The strength of a generated password is wasted if it is reused or written on a sticky note.

When this comes up

• Creating an account that matters. Email, banking, and anything holding payment details. These are the accounts where a weak password causes real damage.
• Replacing a password after a breach. When a service reports a leak, the correct response is a new unique password everywhere that password was reused.
• Choosing a Wi-Fi or device passphrase. Longer is better here because typing happens rarely and the threat is offline cracking.
• Setting up a shared account. Generating a strong password and putting it in a manager is safer than something memorable that three people half-remember.

Questions