Length beats complexity
Attackers guess passwords by trying enormous numbers of combinations. Every extra character multiplies the work, so a long random password is far stronger than a short one full of symbols. Aim for at least 16 characters for important accounts.
Generate it
- Open the Password Generator.
- Set the length to 16 or more and keep upper case, lower case, digits and symbols ticked. Tick Avoid look-alikes if you will ever type it by hand.
- Copy it into your password manager.
Passwords come from your browser's secure random generator and are never sent anywhere.
Use a different password everywhere
When one website is breached, attackers try the leaked email and password on other sites. A unique password for every account stops one breach turning into many. A password manager (the one built into your browser or phone works) remembers them for you.
Passwords you must remember
For the few you type from memory, such as your computer login or password manager, a passphrase of four or five unrelated random words is long, strong and easier to recall than a jumble of characters.
Turn on two-factor authentication
An authenticator app or security key means a stolen password alone is not enough to get in.
How long each kind takes to guess
Strength is measured in bits: each extra bit doubles the number of guesses. The times assume ten billion guesses a second, which is realistic offline against a leaked password database with a fast hash.
| Password | Bits | Time to try every option |
|---|---|---|
| 8 random characters, all types | 52 | about 7 days |
| 12 random lowercase letters | 56 | about 3.5 months |
| 5 random words from a 7,776-word list | 65 | about 90 years |
| 12 random characters, all types | 79 | about 1.5 million years |
| 16 random characters, all types | 105 | far longer than the age of the universe |
These figures hold only for passwords chosen at random. A password a person makes up is guessed much sooner.
Passwords that look strong but are not
- Patterns such as Summer2026! A season or name, a year and a symbol at the end is the first thing cracking tools try.
- Swapped letters such as P@ssw0rd. Swapping a for @ and o for 0 is built into every cracking tool and adds almost nothing.
- Quotes and song lines. Famous phrases are in the word lists attackers use, however long they are.
Security questions
Answers such as a mother's maiden name or first school can often be found online. Treat them as extra passwords: give a random answer and store it in your password manager.