A password's strength is the number of equally likely possibilities an attacker must search. Length raises that number exponentially; clever substitutions barely move it.
Length is the only lever that scales
Each extra character multiplies the search space by the size of the alphabet. Adding one character to a 62-symbol alphabet multiplies the work by 62; replacing an "a" with "@" multiplies it by roughly nothing, because cracking tools try those substitutions first.
As a practical floor in 2026: 16 random characters for anything valuable, 20 or more for an email account or password manager vault, since those unlock everything else.
Random beats memorable-looking
Human-invented passwords cluster around names, dates, keyboard runs, and dictionary words with predictable decoration. Attack tools model exactly those patterns, so a password that looks messy to you can still be guessed quickly.
A generator using the browser's cryptographic random source draws each character independently, which is what makes the strength estimate meaningful. Nothing needs to leave your device for that to work.
Passphrases where you must type it by hand
For the handful of secrets you type manually — device login, vault master password — five or six unrelated random words are both strong and typable. The words must be chosen randomly; a quote or lyric is a single guess to an attacker with a corpus.
Reuse is the failure that actually gets people
Breach databases are cross-referenced automatically, so one reused password turns a forum leak into an account takeover elsewhere. Unique passwords per site matter more than any individual password's strength.
Store them in a manager, turn on two-factor authentication for email, banking, and anything holding payment details, and prefer app-based codes or passkeys over SMS where offered.
Last reviewed 2026-08-31.