How to Create a Strong Password You Don’t Have to Remember

What actually makes a password strong

Attackers guess passwords with software that tries billions of combinations and lists of leaked passwords. A password is strong when it is long, random and used nowhere else. Length matters most: every extra character multiplies the number of guesses needed.

Names, birthdays, keyboard patterns like “qwerty123” and words with a number on the end are the first things guessing software tries.

A simple rule that works

Use at least 16 characters with a mix of upper- and lowercase letters, numbers and symbols, and never reuse a password on two sites. If one site is breached, reused passwords let attackers into your other accounts too.

Let a generator do the work

People are bad at being random. The password generator uses your browser’s secure random source to create passwords no one can predict, and it never sends them anywhere. Copy the result straight into the sign-up form.

Store them, don’t memorise them

A password manager remembers every password for you, so you only need one strong master password. Turn on two-factor authentication for email and banking — even a stolen password is then not enough to get in.

Want to check an existing password? The password strength checker rates how strong it is and shows what would make it stronger.