What actually makes a password strong
Four properties matter. Most of the advice people repeat is about the least important one.
The four properties
- Length — the dominant factor in resisting brute force. Each character multiplies the search space.
- Randomness — unpredictable selection, so an attacker cannot use patterns, dictionaries or grammar.
- Uniqueness — never reused, so a breach elsewhere does not reach this account.
- Storage — held in a password manager rather than memory or a notes file.
What does not make a password strong
Substituting letters with symbols (p@ssw0rd) is a known transformation that cracking tools apply automatically. It costs you typing accuracy and buys almost nothing.
Personal information — names, dates, pet names, sports teams — is the first thing a targeted attacker tries, and it is often public.
Complexity rules that force one of each character class tend to produce 'Summer2024!' patterns that are both predictable and hard to remember.
The practical recipe
Use a password manager to hold a 16-character random password per account. For the few passwords you must memorise — the manager's master password, a device passcode — use a passphrase of six random words, which gives about 78 bits and is genuinely recallable.
Then fix the storage problem, because it is the one that breaks everything else: a reused password turns any breach into a chain of account takeovers.
Frequently asked questions
How long should a strong password be?
16 characters from the full set, about 103 bits. Above that, the risk shifts from guessing to phishing.
Are password generators trustworthy?
They are if they run locally and use a cryptographic random source. You can verify the first property yourself in the browser's Network tab.
Is two-factor authentication a substitute for a strong password?
It covers different failures — phishing and credential stuffing — but does not excuse a weak or reused password. Use both.