How to choose a strong password — and why your browser already does the hard part

What makes a password weak

Short length. Real words. Reuse across sites. The character of a password is almost irrelevant if the password is one of the top 10,000 most-used strings, because the attacker tries those first. "Password123", "qwerty", and your dog's name followed by a birth year are not strong passwords — they are guesses, and the guessing is automated.

What makes a password strong

Length. Randomness. Uniqueness. The only thing the attacker cannot guess is a string that was never their dictionary, and the cheapest way to get one of those is to make it long and machine-generated. A 16-character random password from a password manager is, for practical purposes, uncrackable. A 6-character password you can remember is, for practical purposes, already cracked.

Why the old advice was wrong

For 20 years, security guidance told you to add a symbol, capitalise one letter, and change the password every 90 days. The advice was wrong. It produced passwords that are slightly harder for humans to remember and slightly easier for computers to guess, because the rules create a smaller search space than a fully random string. The modern guidance (NIST SP 800-63B, 2017 and 2024 revisions) is: use a long machine-generated string, never reuse it, do not force periodic changes. Two-factor authentication is the actual defence against credential theft; the password is the second layer, not the first.

How password managers work

A password manager generates, stores, and fills passwords for you. The browser's built-in manager (Chrome, Safari, Firefox, Edge) is now good enough for most people — it generates 20+ character random passwords, stores them locally or in the cloud, and fills them in. Dedicated managers (1Password, Bitwarden, KeePass) add features: cross-device sync, family sharing, breach alerts, secure notes. Either way, the principle is the same: you remember one long passphrase, the manager remembers the rest.

Two-factor authentication

A password is one factor: "something you know". Two-factor adds a second one, usually "something you have" (a phone, a hardware key) or "something you are" (a fingerprint). Even if your password is stolen, the attacker cannot log in without the second factor. Use an authenticator app (Authy, Google Authenticator, 1Password) or a hardware key (YubiKey, Titan) for important accounts. SMS codes are better than nothing but are vulnerable to SIM-swap attacks.

What this site gives you

A free, browser-side password generator that creates 8–64 character random strings with adjustable character classes. A hash generator if you ever need to check whether a file has been tampered with. Both are offline, both run in your browser, both leave nothing on the server.