How to Create Strong, Unique Passwords for Every Account

A password's resistance to guessing is measured in entropy — essentially, how many equally likely possibilities an attacker must try. For a password built from a known character set, the count of possibilities is the size of the character set raised to the power of the length. An eight-character password using upper case, lower case, and digits offers 62 to the power 8, roughly 218 trillion combinations. That sounds enormous until you put it against modern hardware: consumer GPUs run trillions of guesses per second against common hash formats, and an eight-character password falls in hours to days.

Length moves the arithmetic decisively. Sixteen characters from the same 62-symbol set is 62 to the power 16 — the square of the eight-character space, around 47 sextillion sextillion combinations, a number that turns offline guessing from a weekend project into a geological one. Each additional character multiplies the work by 62; there is no complexity trick that competes with simply adding characters.

This is why the modern guidance has flipped from "add more symbol types" to "make it longer." A short password full of exotic symbols is weaker than a long passphrase of ordinary words, and it is also harder to type. The classic four-word passphrase — something like twenty-plus lowercase letters — outperforms most eight-character "strong" passwords by a wide margin while being memorable enough to survive without a sticky note.

The arithmetic above assumes every character is equally likely. Human beings do not choose that way: we pick pronounceable fragments, capitalise the first letter, append a year, and substitute "a" with "@" in predictable places. Attackers know all of this, and real cracking runs dictionary words, common substitutions, leaked-password lists, and pattern rules before it ever tries random brute force. A password that "looks random" to its owner may sit in the first few percent of an attacker's search order.

This is the strongest argument for generated passwords: they are drawn uniformly from the character space, so their entropy is actually what the length suggests, with no human-shaped shortcuts for an attacker to exploit. A generated sixteen-character string has no pronounceable runs, no dates, no leetspeak — nothing but uniformly distributed symbols.

The companion argument is uniqueness. The dominant real-world attack is not brute force at all — it is credential stuffing: attackers take username and password pairs from one breached service and replay them against every other service. A brilliant password reused across sites is, in that attack, exactly as weak as the worst site you used it on. Uniqueness per account is not optional hygiene; it is the primary defence.

Not all randomness is equal, and the difference is invisible to the eye. A general-purpose pseudo-random generator like JavaScript's Math.random is designed for speed, not unpredictability: its output is a deterministic sequence from a seed, and its internal state can be inferred from observed outputs. For a password, that is a real weakness — if the generator is predictable, the entropy you think you have is not the entropy you have.

Cryptographic randomness comes from a different source entirely. The Web Crypto API's getRandomValues draws from the operating system's cryptographic random pool, which is seeded from physical noise — timing jitter, device interrupts — and is designed so that observing any amount of output gives an attacker no advantage in predicting the next value. This is the same class of source used for cryptographic keys, and it is what any serious password generator should use.

The practical implication when choosing a generator tool: check that it uses a cryptographic source rather than a convenience function. The Password Generator on this site uses the Web Crypto API, so a generated password has the entropy its length implies. A password generated from Math.random may look identical and be dramatically weaker in the one dimension that matters — whether an attacker who knows the tool can reproduce or predict it.

The advice "use a unique, long, random password for every account" is impossible to follow from memory — a person with a hundred accounts cannot hold a hundred sixteen-character random strings in their head. The resolution is a password manager: it holds the vault, and you remember one strong master passphrase. Every individual password can then be generated, unique, and arbitrarily long, because you never need to recall it.

The standard objection — "what if the manager is breached?" — deserves a straight answer. A reputable manager encrypts your vault with your master password using a slow key-derivation function, so a stolen vault file is a pile of ciphertext that must be attacked one master password at a time. Meanwhile, the alternative — reuse — is breached routinely and successfully at scale. The manager concentrates risk behind one very strong secret; reuse distributes weakness across your entire digital life. The manager is the better trade by a wide margin.

Generated passwords also pair naturally with the manager's workflow: generate, use once, never type it again. That removes the temptation to choose something memorable, which is precisely the behaviour that produces weak passwords.

Compare two passwords a person might actually choose. The first is "P@ssw0rd!" — nine characters, with upper, lower, digit, and symbol, the kind a typical strength meter rates as strong. Against a uniform brute-force search of the 94 printable ASCII characters, nine characters is 94 to the power 9, roughly 5.7 times 10 to the 17 combinations. But this password is not uniform — it is a dictionary word with predictable substitutions, so a real cracking run reaches it in the first fraction of a percent of the search space. Its effective entropy is a small fraction of what its length suggests.

The second is a four-word passphrase of 28 lowercase characters. Against even a reduced 26-character lowercase search, that is 26 to the power 28 — a number so large that offline guessing at a trillion attempts per second would run for many orders of magnitude longer than the age of the universe. And because the words are chosen randomly rather than for meaning, there is no dictionary shortcut that collapses the space the way it does for the first password.

The lesson is not that passphrases are magic — it is that entropy scales with length, and human-chosen patterns destroy the entropy their length implies. A generated 16-character password from the full printable set sits between the two, with the advantage that a generator guarantees uniformity. The decision framework: prefer length over symbol variety, prefer generated over human-chosen, and prefer unique over memorable — because the dominant real-world attack is credential stuffing, and uniqueness defeats it where strength alone does not.

Strong passwords defend against guessing. They do nothing against phishing — a page that convincingly imitates a login form and simply asks for your password will receive it, however strong it is. The defence there is habit: reach services through bookmarks or typed URLs rather than links in email, and treat any urgent login request with suspicion.

The other major defence is a second factor. Even a modest second factor — an authenticator app on your phone — defeats the entire offline-guessing threat class, because a correct password alone no longer opens the account. The strongest password and a second factor together cover the two dominant attack families: guessing and replay. Length and uniqueness handle the first; the second factor handles the fallout when some other site leaks a password you once used.

The complete personal policy, in one sentence: generate long random passwords with a cryptographic source, store them in a manager, never reuse them, and turn on a second factor wherever it is offered. Every element of that sentence is boring, and all of it together is what actually works.

One more consideration worth noting: password strength matters most at the points where an attacker can try guesses offline, against a stolen hash, without rate limits or lockouts. A website that locks your account after five attempts makes even a weak password hard to guess online, but if that website is breached and the password hashes leak, the attacker tries billions of guesses per second against the hash directly, with no website in the loop. This is why length and randomness matter even for accounts that seem protected by lockout policies: the breach scenario is the one that tests the password itself, and it is the scenario where a generated sixteen-character password holds and a short human-chosen one falls in hours.