A complete guide to creating passwords that protect your accounts from brute-force and dictionary attacks.
Password strength is measured in entropy — the number of bits of randomness. Higher entropy means more possible combinations an attacker must try. A password with 80+ bits of entropy is considered strong against modern hardware.
Weak (<36 bits)
Cracked in seconds to minutes
password123
Fair (36–60 bits)
Cracked in hours to days
Tr0ub4dor&3
Strong (60+ bits)
Years to centuries to crack
xK9#mP2$vL7@nQ4
Every additional character exponentially increases crack time. A 16-character password with mixed characters has over 100 bits of entropy.
Use uppercase, lowercase, digits, and symbols. Each type increases the pool size — from 26 letters to 95+ printable characters.
Human-created passwords follow predictable patterns. Use a cryptographic random generator (like this tool) for true randomness.
If one account is breached, attackers try those credentials on other sites. Every account needs a unique password.
Store your passwords in a dedicated password manager (1Password, Bitwarden, KeePass). Never rely on memory or browser autofill alone.
Even strong passwords can be phished. Add a second factor (authenticator app, hardware key) for critical accounts.
Read our full Password vs Passphrase comparison for more details.
Use our free password generator for cryptographically secure passwords.
Generate Password