Strong Passwords Made Simple: Length, Randomness and Good Habits

What makes a password strong

Strength comes from unpredictability. A password is hard to crack when an attacker has no pattern to exploit, so names, birthdays, keyboard runs like qwerty and clever substitutions such as p@ssw0rd are all weak. Attackers try those habits first.

The safest passwords are random, long and used for only one account.

Length beats complexity

Every extra character multiplies the number of possibilities an attacker must try. A random password of 16 characters is far harder to crack than a short one packed with symbols. Aim for at least 14 to 16 characters for important accounts, and longer where the site allows it.

Complexity still helps when mixing upper case, lower case, numbers and symbols, but it is length that does most of the work.

Attackers use two main methods. In a guessing attack, software tries common passwords and patterns at very high speed. In a credential stuffing attack, it tries leaked email and password pairs on other sites. A random, long and unique password defeats both, because there is no pattern to guess and no old leak that matches. This is why generating passwords randomly beats inventing them yourself, even when your invented one feels clever.

Generate one with the PDFImgTools password generator

The Password Generator uses your browser's cryptographic random generator, so the result is not based on a guessable pattern. Nothing is sent anywhere; the password exists only on your screen.

1. Open the Password Generator and drag the length slider to 16 or more.
2. Choose which character types to include: upper case, lower case, numbers and symbols.
3. Turn on the option to avoid look-alike characters if you may need to type the password by hand.
4. Watch the strength meter and increase the length if it is not in the strongest range.
5. Copy the password and save it straight into your password manager.

Use a password manager and never reuse

Nobody can remember dozens of random passwords, and nobody should try. A password manager stores them behind one strong master password and fills them in for you. That makes it realistic to use a different password everywhere.

Reuse is the biggest danger. When one site leaks its data, attackers try the same email and password on other services. A unique password for each account limits the damage to one.

When a passphrase is the better choice

Some passwords you must type from memory, such as the master password for your manager or a laptop login. For those, a passphrase of four or more unrelated words, for example separated by spaces or hyphens, is both strong and memorable. Choose the words randomly rather than picking a quote or a lyric, since familiar phrases are easier to guess.

• Use random generation for accounts stored in a manager.
• Use a long passphrase for the few secrets you must remember.
• Turn on two-step verification wherever it is offered.
• Change a password immediately if a service reports a breach.

A practical scenario

A small shop owner discovers she uses one password for email, the online store and the bank. She generates a 20 character password for each, stores them in a manager, and sets a long passphrase as the master password. The next breach notice she receives affects only one account, and she changes a single password in under a minute.

Frequently asked questions