How to Create a Strong Password (and Remember It)

Why weak passwords get cracked

Attackers rarely guess passwords by hand. They use software that tries billions of combinations per second, starting with common passwords, dictionary words, names and leaked passwords from previous breaches. Short passwords and predictable patterns like “Summer2026!” fall within minutes.

What makes a password strong

• Length: at least 16 characters for important accounts. Each extra character multiplies the number of possible combinations.
• Randomness: no words, names, dates or keyboard patterns.
• Variety: a mix of upper and lower case letters, numbers and symbols.
• Uniqueness: a different password for every account, so one breach does not unlock everything.

Generate a strong password in seconds

1. Open the Password Generator.
2. Set the length to 16–24 characters and keep all character types selected.
3. Turn on “Avoid look-alikes” if you will need to type the password by hand.
4. Copy the password into your password manager.

How to remember them all

You should not try to memorise dozens of random passwords. Use a password manager (such as Bitwarden, 1Password or your browser’s built-in manager) to store them, and protect it with one long passphrase you remember — for example four or five random words.

Passwords to avoid

• Names of people, pets or places, even with numbers added.
• Keyboard patterns such as “qwerty”, “123456” or “asdf”.
• Dates of birth, anniversaries or phone numbers.
• The same password with a different number at the end for each site.
• Any password that has appeared in a data breach — check yours at haveibeenpwned.com.

What to do after a data breach

Data breaches happen even at large, well-run companies, so it is wise to have a plan. Acting quickly limits the damage, especially if you reused the password elsewhere.

• Change the password on the affected site immediately.
• Change it anywhere else you used the same password.
• Turn on two-factor authentication on the account.
• Watch for phishing emails that use details from the breach.

Add a second layer

Turn on two-factor authentication (2FA) for email, banking and social media. Even if a password leaks, an attacker also needs the code from your phone or security key.