How to pick a strong password in 2026
Updated October 29, 2026
Password rules were written for humans typing eight characters: a capital, a digit, a symbol. Attackers do not guess like humans; they try billions of combinations per second against leaked databases. What stops them is length and randomness.
Here is what works today, and what to stop doing.
Length beats complexity
Every extra character multiplies the work for an attacker; a symbol adds a little, a character adds a lot. Twelve random characters survive any offline attack for years; sixteen, for centuries. A 20-character passphrase of four random words is both stronger than "P@ssw0rd1!" and easier to type.
One password per site
The common break-in is not guessing: it is reusing. One shopping site leaks, and the same email-plus-password is tried on your mail and bank within hours. A password manager (the one in your browser is fine) makes unique passwords free; you remember one strong master passphrase and nothing else.
Generate, do not invent
People invent patterns, and patterns are what cracking tools try first (a word, a year, a symbol at the end). The password generator here uses the browser's cryptographic random source; nothing is sent anywhere, and the strength meter shows how long an offline attack would take for what you have.
Add a second factor where it matters
Mail, bank, cloud storage: turn on two-factor authentication, preferably an authenticator app or a passkey rather than SMS. A leaked password is then useless on its own.
Tips
- A passphrase for the master password; random strings for everything else.
- Change a password when a service reports a breach, not on a calendar.
- Never type a password into a page you reached from a link in an email.
Questions
- How long should a password be?
- 16 characters random, or a passphrase of 4 to 5 words. 12 is the floor.
- Are symbols required?
- Only when the site insists. Length matters far more; add one symbol to satisfy the rule and move on.
- Is the generator safe?
- It runs in your browser with the Web Crypto API; no password leaves the page or is logged.