Guides password security online safety privacy

How to Create a Strong Password (and Keep It Safe)

By ClickSolveTools Editorial TeamUpdated 10 min read

A strong password is long, random, and used on only one account. Aim for at least 16 characters (CISA's advice), or a passphrase of several unrelated random words. Let a password manager create and store them, and add a passkey or multi-factor authentication (MFA) to the accounts that matter most, starting with your email.

Length beats complexity because every extra random character multiplies an attacker's work, while swapping an "a" for "@" barely changes it. This guide shows the math, what NIST's 2025 rules say, how password generators pick random characters, and what to do after a breach. To make a password right now, use our Password Generator.

The Short Checklist

What Breaches Look Like in 2026

Why Length Beats Complexity

For decades the advice was 8 characters with a capital, a number and a symbol. That produces passwords such as "P@ssw0rd!" that are hard for people to remember and easy for cracking tools, which try dictionary words with common substitutions first. Strength comes from entropy, a measure of unpredictability in bits. Each bit doubles the number of guesses needed.

Entropy (bits) = length x log2(pool size) Pool sizes: 26 lowercase letters 4.70 bits per character 52 upper and lowercase letters 5.70 bits per character 62 letters and digits 5.95 bits per character 91 characters (our generator, all four sets) 6.51 bits per character 7,776 words (EFF long list) 12.92 bits per word

That formula only holds when every character or word is picked at random. "P@ssw0rd!" is 9 characters, but it is not random, so its real strength is close to zero. Here is what random choices are worth, assuming an offline attack on a stolen database at 10 billion guesses per second (the same assumption our Password Strength Checker uses) and counting the average time as half the possible combinations:

Random password Entropy Average time to guess
8 lowercase letters 37.6 bits about 10 seconds
8 characters, all four sets 52.1 bits about 3 days
12 lowercase letters 56.4 bits about 55 days
12 characters, all four sets 78.1 bits about 510,000 years
16 characters, all four sets 104.1 bits about 35 trillion years
4 random words (EFF list) 51.7 bits about 2 days
5 random words (EFF list) 64.6 bits about 45 years
6 random words (EFF list) 77.5 bits about 350,000 years

Two lessons follow. First, length wins: 12 plain lowercase letters (56.4 bits) beat 8 characters from every set (52.1 bits). Second, the guess rate matters. A site that stores passwords with a slow, salted hash such as Argon2id makes each guess far more expensive, while fast hashes such as SHA-256 (you can compute them in our Hash Generator) are what OWASP says are unsuitable for passwords. You cannot see how a site stores yours, so pick length that survives the fast case.

The well-known xkcd comic 936 made the same point in 2011. It assumed a 2,048-word list (11 bits per word, so 44 bits for four words) and 1,000 guesses per second, which is why its bit counts and times differ from the table above: long, random and memorable beats short and clever.

The Passphrase Method

If you must remember a password, such as the master password for your password manager, use a passphrase: several words picked at random, not words that mean something to you. CISA describes a passphrase as 4 to 7 unrelated words, and the EFF recommends at least six from its long list of 7,776 words, which is about 12.9 bits per word.

grief-blanket-sketch-fetch-jewel-goat duck-stairs-poverty-fine-enemy-math

Those are examples only. Anything printed in public is not a secret, so generate your own. The words must come from a random process (dice or a generator), not from a song lyric, a quote, or your own head. Our generator's Passphrase mode picks 4 to 8 words from a list of about 2,000 words, which is about 11 bits per word: 5 words is 54.9 bits (about 19 days at 10 billion guesses per second), 6 words is 65.9 bits (about 107 years), and 8 words is 87.8 bits. For anything important, set 7 or 8 words there, or roll six words from the EFF list.

Never Reuse Passwords

The only defense that scales is a different password for every site. A password manager is what makes that realistic.

What NIST Says Now

NIST's Digital Identity Guidelines, Revision 4 (SP 800-63B-4, 2025), set the rules US agencies and many companies follow. They are written for services, but they tell you what to expect and what you can stop doing:

Password Managers

A password manager stores your passwords in an encrypted vault protected by one master password, so, as CISA puts it, you only need to remember one strong password. It generates a unique password for each site, fills them in, and warns you about weak or reused ones. Because it typically fills a login only on the matching web address, it also helps you avoid typing a password into a fake site.

Options include Bitwarden (open source with a free tier), 1Password (paid), KeePass (open source, keeps a local file) and the managers built into browsers and phones. Any of them beats reusing passwords. Protect the vault with a long, unique master passphrase and MFA. In the 2022 LastPass incident, attackers copied encrypted vault backups, and the safety of each stolen vault came down to the strength of its master password.

MFA and Passkeys

A second factor limits the damage when a password leaks or is phished. Not every factor is equal. CISA calls FIDO and WebAuthn authentication the only widely available phishing-resistant method, and lists one-time codes, push approvals and SMS as methods that can still be phished or relayed. From strongest to weakest:

Turn MFA on for your email account first, since email can reset every other password.

How Password Generators Work: CSPRNG vs. Math.random

A generator is only as good as its randomness. MDN is blunt about Math.random(): it does not provide cryptographically secure random numbers and must not be used for anything related to security. Use crypto.getRandomValues() from the Web Crypto API instead. Browsers fill it from a cryptographically strong generator that the operating system seeds with high-entropy data, such as /dev/urandom on Unix systems.

// Insecure for passwords const ch = charset[Math.floor(Math.random() * charset.length)]; // Secure: pick an index with rejection sampling to avoid modulo bias function randomIndex(max) { const limit = Math.floor(0x100000000 / max) * max; const buf = new Uint32Array(1); do { crypto.getRandomValues(buf); } while (buf[0] >= limit); return buf[0] % max; } const pick = chars => chars[randomIndex(chars.length)];

Our Password Generator uses crypto.getRandomValues() and creates the password on your device, so it is never sent anywhere. Password mode covers 8 to 128 characters (16 by default) from any mix of the four sets, and Passphrase mode covers 4 to 8 words. You can confirm nothing is transmitted by watching your browser's Network tab while you generate.

What to Do If Your Password Is Breached

If a service, a password manager or Have I Been Pwned tells you your credentials leaked, do these in order:

  1. Change the password on the breached site, using a new, unique one from your manager.
  2. Change it everywhere you reused it. This is the most important step.
  3. Turn on MFA or a passkey on the affected accounts.
  4. Review activity. Check sign-in history, connected apps and forwarding rules on the compromised accounts.
  5. Watch for password-reset emails you did not request, which can mean someone is testing your other accounts.
  6. Consider a credit freeze if financial or identity details leaked. The FTC says placing and lifting a freeze is free.

Have I Been Pwned's Pwned Passwords check uses k-anonymity, so only the first 5 characters of a password's hash are sent. Even so, never type a live password into a site you do not trust. Generate a new one instead. More tools like it are in the Generators hub, and for how sign-in tokens work after you log in, see our JWT explainer.

Frequently Asked Questions

How long should my passwords be?

For a random password, use at least 16 characters, which is CISA's advice. For a passphrase you have to memorize, use six random words from a long list such as the EFF list, since the EFF recommends at least six. Length costs nothing when a password manager types it for you.

Is it safe to write down passwords?

A written password kept somewhere physically secure is safer than reusing one password online, because it cannot be attacked over the internet and can only be stolen in person. For most people a password manager is the better choice. Do not stick notes on a monitor or keep the list somewhere shared or public.

Should I change my passwords regularly?

No. NIST's current guidance (SP 800-63B-4) says services must not require periodic password changes and must force a change when there is evidence of compromise. Forced rotation pushes people toward predictable edits such as Password1 to Password2. Change a password when a breach, phishing or shared access gives you a reason.

Are passkeys replacing passwords?

Slowly. A passkey is a FIDO credential stored on your phone, computer or security key that signs you in the way you unlock your device, and it resists phishing. Passkeys are supported in all major operating systems and browsers, and a 2025 FIDO Alliance survey of 1,389 people in five countries found that 69% had enabled one on at least one account. Many sites still require passwords, so use passkeys where offered and strong, unique passwords everywhere else.

Are password managers safe to use?

A reputable manager encrypts your vault, so a stolen copy is only as strong as your master password, which is why it should be long and used nowhere else. In the 2022 LastPass incident, attackers copied encrypted vault backups, and LastPass said vaults protected by long, unique master passwords were at lower risk. Turn on multi-factor authentication for the manager account itself.

Sources

Figures and rules in this guide were checked against these primary references in September 2026: