How long should a password be?

At least 12 characters; 16 or more is better, and length matters more than special characters.

Are passphrases better than complex passwords?

Yes — a few unrelated words are both harder to crack and easier to remember than a short cryptic string.

Should I use a password manager?

Yes — it generates and remembers a unique strong password for every site so you don't have to.

How to Create a Strong Password

Published 11/4/2025 · 3 min read · Developer tools

Daniel Okonkwo — Front-end developer and tech writer at Allin

Web performance · File formats

Checked against 2 sources

View profile →

In short

A strong password is long and unpredictable: aim for at least 12–16 characters, mix unrelated words or random characters, and never reuse it across sites. Length beats complexity — a four-word passphrase like 'copper-violin-tunnel-sparrow' is both strong and memorable. Better still, let a password manager generate and store a random one for every account.

Length beats complexity. Here's why a four-word passphrase is strong, why you should never reuse a password, and how a manager makes it effortless.

Length beats complexity

Every extra character multiplies the number of guesses an attacker must try, so length is the single biggest lever on strength. A short password packed with symbols is weaker than a longer, simpler one: 'P@4z!' can fall in moments, while a 16-character phrase would take an impractical amount of computing time to brute-force. Aim for at least 12 characters and treat 16 or more as the comfortable target.

Passphrases you can remember

The trick to a password that is both strong and memorable is a passphrase: four or five unrelated words strung together, like 'copper-violin-tunnel-sparrow'. It is long, which makes it hard to crack, but it tells a little picture your brain can hold. Crucially the words must be random, not a quote or a phrase you've seen — 'to-be-or-not-to-be' is weak because attackers try known phrases first.

Never reuse a password

Reuse is the quiet killer. When one site is breached, attackers take the leaked email-and-password pairs and try them on hundreds of other services — a trick called credential stuffing. If you used the same password on your email, bank and shopping accounts, one leak opens them all. A unique password per site contains the damage to that single account, which is why uniqueness matters as much as strength.

Let a manager do the work

Nobody can remember a long, unique password for every account — and you don't have to. A password manager generates a random password for each site, stores it encrypted, and fills it in for you; you only remember one strong master password. Pair it with two-factor authentication on your important accounts, so that even a stolen password isn't enough to get in. Together they turn good password habits from a chore into a default.

Password generatorGenerate a strong, random password — free and secure.Try the tool →

Frequently asked questions

How long should a password be?: At least 12 characters; 16 or more is better, and length matters more than special characters.
Are passphrases better than complex passwords?: Yes — a few unrelated words are both harder to crack and easier to remember than a short cryptic string.
Should I use a password manager?: Yes — it generates and remembers a unique strong password for every site so you don't have to.

Articles you may find interesting

All guides →

GuideGenerating an Application Secret Key CorrectlyHow to tell a sound secret-key generator from an unsound one, using this one as a worked example: which random source it calls, how to compute the entropy yourself, and what actually breaks the day you rotate the key.ExplainerWhat Is a QR Code?A QR code is a 2D barcode a camera reads to open a link or text. Here's what it is, why it holds so much, its anatomy, and a safety note on scanning.ExplainerWhat Is a Hash Function? (MD5, SHA-256)A hash function turns any input into a fixed-size fingerprint. Here's what it does, its key properties, common uses, and which algorithms are safe.ExplainerWhat Is a JWT (JSON Web Token)?A JWT is a compact, signed token used to carry identity between services. Here's its three parts, how it's used for auth, and its security limits.ExplainerWhat Is a UUID (and When to Use It)?A UUID is a 128-bit identifier that's unique without any central authority. Here's what it looks like, why it's useful, the versions, and when to use one.ExplainerWhat Is a Cron Expression?A cron expression schedules a task to run automatically at set times. Here's what it's for, its five fields, how to read one, and the common gotchas.

Sources

Spotted a mistake in this article?