The weakest point in most people’s online security isn’t the email service or the network — it’s the passwords. Most users reuse the same handful across dozens of accounts, use predictable patterns, or choose passwords short enough that an automated attack cracks them in minutes. Creating strong passwords is the foundational skill that every other security practice builds on. This fits into the wider topic we cover in our Complete Guide to Online Security and Privacy.
Three distinct attack types determine what “strong” actually means: brute force (trying every possible combination), dictionary attacks (trying common words and known patterns from breach databases), and credential stuffing (using a stolen password from one breach to attempt access on other services). A genuinely strong password defeats all three — not just the one that feels most obvious.
What actually makes a password strong
Most weak passwords aren’t weak because they look simple. They’re weak because they follow patterns. The most common patterns in breach databases, in order of frequency:
- Short passwords (under 10 characters)
- Keyboard patterns (qwerty, 12345678, asdfgh)
- Dictionary words with minimal substitutions (p@ssw0rd, s3cur1ty)
- Names combined with birth years (sarah1992, mike1987)
- Passwords matching the service name (facebook2024, gmail123)
None of these are in the first candidate lists automated attackers try because they look simple. They’re there because they’re statistically predictable.
A genuinely strong password has four properties:
- Long: at least 16 characters, ideally 20+
- Random: not derived from any word, name, date, or predictable pattern
- Unique: not used on any other account
- Stored securely: in a password manager, not a browser without a master password or a text file
Length matters more than complexity for resisting brute force. A 20-character lowercase-only random string is mathematically stronger than a 10-character password mixing uppercase, numbers, and symbols, because the attack space grows exponentially with length. The traditional advice to “add uppercase and symbols” produces passwords like “P@ssw0rd” that feel complex but are in every dictionary attack list in existence.
Using a password manager generator — the right approach for most passwords
The correct tool for creating strong passwords at scale is the built-in generator in any reputable password manager. Human beings are reliably poor at generating randomness — our “random” choices contain detectable patterns that automated tools exploit. The generator eliminates human bias entirely.
In Bitwarden: browser extension → key icon in the autofill popup → generator tab. Configure: 20+ characters, all character types enabled (uppercase, lowercase, numbers, symbols), minimum counts for each type if available. Generate a fresh password for each new account. The password is automatically copied to the clipboard and can be saved directly to a new vault entry.
For accounts with broken password requirements that reject symbols: increase the length to 24+ characters to compensate. Length provides more entropy per character than most special character requirements contribute.
The passphrase generator option creates word-based passwords — “marble-window-captain-frost-garden” rather than “xK9!mRq2@Lp#”. Easier to type on mobile or when entering credentials on a TV or game console. Use the passphrase option when you need to type the password manually rather than autofill it. Six words or more provides adequate strength; the character string is slightly stronger per character, but both are sufficient when random.
For passwords you must memorise — the Diceware method
The password manager generator can’t be the only tool, because three or four passwords must live in your head rather than the vault: the password manager master password itself, your device login, your primary email account, and your recovery email if different.
The Diceware method is the gold standard for memorisable-but-strong passwords. The process:
- Download the EFF’s Diceware word list (eff.org) — 7,776 common English words mapped to five-dice rolls
- Roll five dice six times
- Look up each five-digit result in the word list
- Assemble the six words as your passphrase: “trumpet-delay-window-fabric-corner-rapid”
Six Diceware words provide approximately 77 bits of entropy — more than enough to resist any known attack. The words should have no meaningful connection, which is exactly the point.
The memory technique: construct a brief narrative linking the words. “A trumpet playing in the delay before the window fabric blew in the corner of the rapid wind.” Bizarre imagery is significantly more memorable than coherent sentences. Write the passphrase on paper immediately and store it physically while you build the memory over a few days of typing it. Once memorised, destroy the paper.
Common mistakes that undermine strong passwords
Reuse is the most damaging. A strong password used on two accounts becomes a liability when either account is breached. Automated tools test stolen passwords against dozens of other services within hours. Every account needs its own independent password — this isn’t a recommendation, it’s the technical requirement for what “strong” means at scale.
Incremental modification is as bad as full reuse. Changing Password1! to Password2! for the next account, or appending the site name (FacebookPass1, TwitterPass1) — these patterns are in credential stuffing attack lists as standard variations. Once the base pattern is known, the variations are trivially tested. A new account needs a fully generated, independent password.
Insecure storage negates strong passwords. A password saved in a browser without a master password is exposed if the browser account is compromised. A text file or spreadsheet is exposed if the device is compromised. A sticky note on the monitor is exposed to anyone with physical access. The secure storage that matches the effort of creating strong passwords is an encrypted password manager with a strong master password and two-factor authentication.
Creating strong passwords and storing them insecurely is equivalent to building a strong safe and leaving it unlocked.
Priority order by account type
| Account type | Password approach | 2FA required? | Storage |
| Password manager master password | 6-word Diceware, memorised | Yes — hardware key or authenticator app | Memory + physical backup |
| Primary email | 6-word Diceware, memorised | Yes — mandatory | Memory + physical backup |
| Financial accounts (banking, investment) | 20+ char generator (all types) | Yes — mandatory | Password manager |
| Work/corporate accounts | Maximum allowed length from generator | Yes if available | Password manager or corporate vault |
| All other accounts | 20+ char generator | Yes where available | Password manager |
Email accounts require special treatment because email is the recovery path for every other account. A compromised email account allows an attacker to reset the password on every other service using the “forgot password” function. The email account should use a memorised Diceware passphrase — ensuring access even if the password manager is temporarily unavailable — plus mandatory two-factor authentication.
Our guide on using a password manager covers vault setup, the generator integration, and the security audit tools for finding weak and reused passwords across all your accounts. Our guide on two-factor authentication covers the second layer that strong passwords alone can’t replace. For the technical basis of password entropy and the updated NIST guidelines (which explicitly recommend against mandatory rotation), NIST Special Publication 800-63B provides the authoritative framework.
Migrating from weak to strong passwords — the practical approach
Changing every password at once is overwhelming and often abandoned. The most efficient approach is opportunistic migration: when you log into a site, check whether the current password is weak or reused. If so, use the password manager’s generator to create a new one and save it to the vault before the next login. Over four to six weeks of normal account use, the highest-risk accounts migrate to strong unique passwords without a single dedicated session.
Password audit tools accelerate this and catch accounts you don’t visit frequently. Bitwarden’s Vault Health Reports, 1Password’s Watchtower, and similar tools in every major password manager identify weak, reused, and breached passwords simultaneously. Running this audit monthly during the transition period and quarterly afterward surfaces the remaining accounts that still need to be updated. The audit sorts by severity — accounts with reused passwords appearing in breach databases rise to the top, making the priority clear.
The goal is a vault where every entry was generated rather than typed by hand. At that point the password manager’s protection model is complete: every account has a unique random password that can’t be guessed, can’t be dictionary-attacked, and can’t be used as a lever against other accounts through credential stuffing. That state is achievable in weeks of opportunistic migration, not months of deliberate effort.
Password requirements that actually hurt security
Corporate and institutional password policies frequently produce less secure passwords than they intend. The patterns worth knowing:
- Mandatory rotation (change your password every 90 days): produces predictable sequences (Password1! → Password2! → Password3!) that are trivially guessable once the pattern is known. NIST’s 2024 guidelines explicitly recommend against rotation unless a breach is known or suspected. Within rotation constraints, use the generator each time and treat each rotation as a genuinely new password.
- Maximum length caps (12 characters maximum): a shorter maximum cap than 16+ characters is a security vulnerability, not a feature. Sites with low length maximums are often running legacy systems with inadequate password storage — a reason to use a completely random generator-derived password rather than anything pattern-based, since the shorter length provides less protection.
- “Complexity” requirements without length requirements: requiring 1 uppercase + 1 number + 1 symbol while allowing 8-character passwords produces passwords like “P@ssw0rd1” — which is in every dictionary attack list. Length with randomness beats complexity without it.
Within whatever corporate constraints apply, use the maximum allowed length, full randomness from the generator, and don’t reuse passwords across work accounts or between work and personal accounts.
For parents — teaching strong password practices
Children and teenagers with online accounts represent a meaningful family security risk if their accounts use weak, shared, or parent-known passwords reused across gaming platforms, social media, and school accounts. A compromised child’s account is frequently used as a vector into family shared services — streaming platforms, family email chains, shared cloud storage.
Teaching older children strong password habits using an age-appropriate password manager — Bitwarden’s free plan supports a single user at no cost — gives them a security skill that serves them for life and removes a family security vulnerability simultaneously. Start with two or three accounts (school login, gaming, a shared family service) and demonstrate how the generator works and why each account gets a different password. The concept is concrete once they see that a 20-character generated password is trivially stored in the manager and trivially filled by the browser extension.
The entropy numbers behind the recommendations
For readers who want the mathematical basis:
- A 12-character random password using 95-character ASCII space: ~79 bits of entropy
- A 20-character random password using the same space: ~131 bits of entropy
- A 4-word Diceware passphrase (7,776 word list): ~52 bits of entropy
- A 6-word Diceware passphrase: ~77 bits of entropy
- A 8-word Diceware passphrase: ~103 bits of entropy
Current cryptographic consensus treats 80+ bits as strong against offline attacks, 128+ bits as strong against any foreseeable attack. A 20-character generator password easily exceeds this; a 6-word Diceware passphrase is just within the lower strong threshold. This is why the length-versus-complexity point matters: getting to 20 characters with a generator is a more reliable path to strong entropy than trying to make a shorter password “complex.”
The practical summary: use a password manager, generate every password you can, use Diceware for the three or four you must memorise, and never reuse a password across accounts. These four rules, consistently applied, address every common password-based attack category and remove passwords from the list of security concerns requiring ongoing attention.
Checking whether your existing passwords are strong enough
If you’re using a password manager and want to assess your current vault, every major manager includes a built-in audit tool:
- Bitwarden: vault.bitwarden.com → Reports → Weak passwords, Reused passwords, Exposed passwords (cross-referenced against Have I Been Pwned)
- 1Password: Watchtower → shows compromised, weak, and reused passwords with severity ratings
- Dashlane: Security Dashboard → identity theft and password health monitoring
- KeePassXC: Database → Database Reports → password quality checking
If you’re not using a password manager yet, Have I Been Pwned (haveibeenpwned.com) accepts email address queries and cross-references against breach databases. A positive result shows which breaches included your email — and likely your associated passwords. This tells you which accounts need immediate password changes, without requiring full audit infrastructure. Related: Secure Password Reset.
Assessing passwords without a manager is harder, but the simple heuristic works for most situations: if you can remember the password without looking it up, it probably isn’t random enough. If you’re using the same password on more than one account, it doesn’t matter how strong it is — it’s reused, which is the vulnerability. And if it’s under 16 characters, it’s a shorter target than necessary given the trivial availability of generation tools that produce 20-character random passwords in one click. If this sounds familiar, Passkeys vs Passwords is worth a look.
