What Makes a Password Strong?
A strong password has four key properties:
- Length: Minimum 12 characters. Every extra character multiplies cracking time exponentially.
- Complexity: Mix uppercase, lowercase, numbers, and symbols.
- Randomness: No dictionary words, names, or patterns. "P@ssw0rd" is weak despite symbols.
- Uniqueness: Never reuse passwords across accounts. Each account needs its own password.
8-character password (letters only): cracked in minutes
12-character mixed: ~200 years
16-character mixed: 34 million years
Every character added multiplies security dramatically.
How to Generate a Secure Password
How to Store Passwords Safely
- Use a password manager: 1Password, Bitwarden (free), Dashlane, or LastPass store all passwords encrypted.
- Never write passwords in plain text — not in email, notes apps, or spreadsheets.
- Enable 2FA: Even if a password is stolen, 2FA blocks unauthorized access.
- Browser "remember password": Built-in browser password storage is acceptable for low-risk accounts but use a dedicated manager for banking, email, and work accounts.
FAQ
Is the password generated on my device?
Yes — passwords are generated using the browser's built-in crypto.getRandomValues() API. Nothing is transmitted to any server. Your passwords are never seen by anyone except you.
How often should I change passwords?
Modern security guidance (NIST 2024) recommends changing passwords only when there's reason to believe they're compromised, not on a fixed schedule. A strong unique password per site is more important than frequent rotation.