What Makes a Strong Password?

A strong password is not a password with three symbols and a capital letter. It is a password that is long, random and unique to one account. Those three properties matter more than any clever substitution.

What makes a password weak

• Reuse. One breach exposes every account that shares the password. Credential-stuffing attacks rely on this.
• Common patterns. Names, dates, sports teams, keyboard walks and famous phrases are tried first.
• Short length. A short password can be guessed or cracked quickly, even if it looks complicated.
• Personal information. Birthdays, pet names and addresses are often public or easy to find.
• Predictable substitutions. Replacing “a” with “@” or “o” with “0” in a dictionary word does not add much.

Length and entropy

Password strength is often described in bits of entropy. Roughly, each bit doubles the number of guesses an attacker needs. A random password from a 94-character alphabet has about 6.55 bits per character. That gives roughly 79 bits at 12 characters, 105 bits at 16 characters and 131 bits at 20 characters.

These numbers assume the password is truly random and that the attacker is guessing blindly. Real attacks also use dictionaries, leaked passwords and knowledge about the person. Randomness is what makes those shortcuts less useful.

Length is the easiest lever. A 20-character random password is much harder to guess than an 8-character password with every symbol class.

Randomness beats clever substitutions

“P@ssw0rd!” feels complex to a person. To a cracking tool, it is a common word with predictable substitutions and a predictable suffix. The search space is small because the pattern is common.

A random string such as v7Q!m2x#Lp9@Rk4$ does not follow a dictionary pattern. It is harder to remember, which is why it belongs in a password manager rather than in your head.

Passphrases can be strong and memorable

A passphrase is a sequence of words. If the words are chosen randomly from a large list, the phrase can have high entropy while being easier to type and remember than a random character string.

The key word is randomly. “correct horse battery staple” is famous and therefore a bad choice. Pick several unrelated words using a generator or dice, and make the total length substantial. Avoid quotes, lyrics and common phrases.

Use a password manager

A password manager generates, stores and fills passwords for you. You only need to remember one strong master password or use a passkey. This makes it practical to use a different random password for every account.

• Choose a reputable manager with a clear security model.
• Use a long master password and enable two-factor authentication on the manager itself.
• Keep a secure backup or recovery method. Do not rely on memory alone.
• Do not store passwords in a plain spreadsheet, a note app or a browser profile you do not control.

Two-factor authentication and passkeys

A password is one factor. A second factor, such as an authenticator app or a hardware security key, makes a stolen password much less useful. Prefer app-based codes or security keys over SMS where possible; SMS can be intercepted or SIM-swapped.

Passkeys go further by replacing the password with a cryptographic credential tied to your device and the site. Where a service supports passkeys, they are worth using. Keep a recovery method in case you lose the device.

Generate one here

The NelcByte password generator uses the browser's cryptographic random source. It does not send the result anywhere. Choose a length of at least 16 characters for important accounts, include the character types the site accepts, and copy the result into your password manager.

The entropy figure is an estimate, not a guarantee. No password is unbreakable if the device is compromised or the site is breached.

After a breach

1. Change the password on the affected account.
2. Change it anywhere else you reused it.
3. Check whether the service supports two-factor authentication and enable it.
4. Review active sessions and revoke anything you do not recognise.
5. Watch for phishing messages that use details from the breach.

A practical checklist

• Use a unique password for every account.
• Prefer 16 characters or more for important accounts.
• Let a password manager generate and store it.
• Turn on two-factor authentication.
• Use passkeys where available.
• Treat a breach notice as urgent.