Most password advice focuses on complexity rules — one uppercase, one number, one symbol — that are easy to measure and don't actually matter as much as the thing nobody mentions: length, and whether you're reusing the password anywhere else.
Length beats complexity
A password is cracked by guessing, and the number of possible guesses an attacker has to try grows exponentially with length, far faster than it grows from adding character types. correcthorsebatterystaple (25 lowercase letters) has roughly as many possible combinations as an 11-character password mixing upper/lowercase, numbers and symbols — and it's far easier for a human to remember or type correctly.
That said, for a password you're not trying to memorize — one stored in a password manager — there's no reason to optimize for memorability at all. In that case, maximize both length and character variety, since you'll never have to type it by hand.
The actual risk is reuse, not weak passwords
The most common way accounts get compromised isn't a brute-force attack against a single strong password — it's credential stuffing: an attacker gets a list of emails and passwords leaked from one breached site, and tries that same combination against hundreds of other sites. If you reused the password, it doesn't matter how strong it was; the attacker already has it in plain text.
This is the actual argument for a password manager: not that it generates stronger passwords than you could think of, but that it makes using a different one for every single site practically effortless, so one breach doesn't cascade into every account you own.
What makes a password resist guessing
- Length first. Aim for at least 16 characters where the site allows it — length is the single biggest factor in how long a brute-force attack takes.
- Randomness over patterns. Keyboard walks (
qwerty123), substitutions (P@ssw0rd) and dictionary words with a number appended are exactly the patterns cracking tools check first, because they're exactly the patterns humans default to. - Unique per site. One password, one account. No exceptions worth making.
- Skip personal details. Birthdays, pet names and addresses are often publicly discoverable and are among the first guesses in a targeted attack.
Generating one properly
A password is only as strong as its source of randomness. Our Password Generator uses your browser's cryptographically secure random number generator — the same class of randomness used for encryption keys — rather than a predictable pseudo-random function, and nothing you generate is ever stored or transmitted anywhere. Set the length as high as the target site allows, include every character type it permits, and let the generator do the part humans are bad at: being genuinely unpredictable.