The short version
Use a different, long, randomly generated password for every account, keep them in a password manager, and turn on two-step login for your email and anything involving money. You only need to memorise one strong password: the one that unlocks your password manager.
Why length matters more than complexity
The strength of a password is about how many guesses an attacker would need. Each extra character multiplies the number of possibilities. A randomly chosen character from the full set of about 94 letters, numbers and symbols adds roughly 6.5 bits of strength, while one chosen from lowercase letters alone adds about 4.7 bits. So a random 12-character password using every character type is roughly 79 bits strong, and a random 16-character one is about 105 bits. Each bit doubles the work for an attacker.
Complexity rules such as "must contain a symbol" help only a little, and they push people towards predictable patterns such as a capital first letter and a number on the end. Length that is truly random does far more.
Passphrases
A passphrase is several random words strung together. If the words are chosen at random from a list of 7,776 words, as in the well-known Diceware method, each word adds about 12.9 bits. Four words give roughly 52 bits, five give about 65 and six give about 78. That is why a passphrase of six random words can match a 12-character random password while being much easier to type and remember.
The important word is random. A phrase you made up, a song lyric or a famous quote is far weaker than the same number of words picked by chance, because attackers try those first.
Why reusing passwords is the real danger
The most common way accounts are taken over is not clever guessing. A site gets breached, its list of emails and passwords leaks, and criminals automatically try the same combinations on banks, email and shopping sites. This is called credential stuffing. If you reuse a password, one weak site can unlock all the others, however strong the password is. A unique password per account limits the damage of any one breach to that one account.
You can check whether your email address has appeared in a known breach on the free Have I Been Pwned service, and change the password for any account that was affected.
Things that do not help
- Swapping letters for symbols such as "p@ssw0rd". Attackers' tools try these substitutions automatically.
- Using personal details such as a pet, a birthday or a team name. They are easy to find or guess.
- Changing passwords on a schedule. Current guidance from NIST, the US standards body, advises against forced regular changes. Change a password when you have a reason to think it has been exposed, not just because a month has passed.
- Writing it in a note, a text or an email to yourself. Those are exactly where an intruder looks first.
Using the Password Generator
The generator makes a random password with your browser's built-in cryptographically secure random number generator, the same standard used for security work, and nothing it makes is sent to a server or stored. Choose a length (16 is a sound default, and longer is better for anything important), choose which character types to include, and press Generate. If you have picked several character types, it makes sure at least one of each is included.
Some websites reject certain symbols or cap the length. If a site refuses your password, switch off symbols or shorten the length a little instead of making one up yourself.
Where to keep them
A password manager, either one built into your browser or phone or a dedicated app, stores and fills in your passwords so that you never need to remember them. Protect it with a long passphrase of your own, and turn on two-step login for the manager and for your email account, since email can be used to reset almost everything else. Start with the accounts that matter most: email, banking, your password manager, and anything linked to your phone number.
Try it yourself
Last updated 2 November 2026. These guides are general information written by the Cwtch.es team. Settings and platform limits change, so check the current details for any service you rely on.