How to Create a Strong Password — Rules, Examples & Free Generator

81% of data breaches involve weak or reused passwords. You don't need to memorize the rules — you need a system that creates strong passwords automatically. Here are the rules, the math, and a free tool that applies them all in one click.

The 5 Rules of Strong Passwords

1. 12 characters minimum, 16-20 ideal — length is the #1 factor in password strength
2. Mix all character types — uppercase A-Z, lowercase a-z, digits 0-9, symbols !@#$
3. No dictionary words — not in any language, not with letter substitutions
4. No personal information — no birthdays, names, addresses, phone numbers, pet names
5. Unique per account — never reuse a password across services

Weak vs Strong: Real Examples

Password	Strength	Why	Time to Crack
123456	✗ Terrible	Most common password on earth	Instant
password	✗ Terrible	Second most common password	Instant
Summer2026!	✗ Weak	Dictionary word + predictable pattern	Minutes
P@ssw0rd!	✗ Weak	Predictable substitutions attackers test first	Minutes
MyDogMax2019	✗ Weak	Personal info + dictionary words	Hours
qwerty!@#123	✗ Weak	Keyboard pattern — attackers test all of these	Hours
j7Kx9mW2	~Moderate	Random but only 8 characters — too short	Days to weeks
Tm4$kP8x#Ln2Qv	✓ Strong	14 chars, random, mixed types	Billions of years
x7#Km9$vQ2&nR4pLw8	✓ Very strong	18 chars, all types, no patterns	Heat death of universe

Why "P@ssw0rd!" Is Terrible

It meets most "strength" rules: uppercase, lowercase, digit, symbol, 9 characters. But attackers don't brute-force in order — they test known patterns first:

• Every word in every dictionary, every language
• Common substitutions: @ for a, 0 for o, 1 for l, 3 for e, $ for s
• Common suffixes: !, 123, 2026, !!, @#
• Capitalization patterns: first letter uppercase, rest lowercase

"P@ssw0rd!" matches every single pattern. An attacker using a dictionary attack with substitution rules cracks it in minutes. A truly random 16-character password has no patterns to exploit.

The Math: Password Entropy

Entropy measures unpredictability in bits. Higher = stronger.

Password Type	Character Set Size	12 Chars (bits)	16 Chars (bits)	20 Chars (bits)
Lowercase only (a-z)	26	~56	~75	~94
+ Uppercase (a-z, A-Z)	52	~68	~91	~114
+ Digits (a-z, A-Z, 0-9)	62	~71	~95	~119
+ Symbols (full set)	95	~79	~105	~131

Security benchmarks: 64 bits = minimum. 80 bits = good. 100+ bits = strong. 128+ bits = overkill for most purposes.

Step-by-Step: Create a Strong Password Now

1. Open Password Generator
2. Set length to 16 (or 20 for high-value accounts)
3. Enable all four character types: uppercase, lowercase, digits, symbols
4. Click generate — a crypto-secure random password appears instantly
5. Click copy — paste it into the account's password field
6. Save it in your password manager (Bitwarden is free)

If the service rejects symbols, regenerate with only uppercase + lowercase + digits. Some older systems have character restrictions.

The Passphrase Alternative

For passwords you need to type manually (master password, Wi-Fi), consider a passphrase — 4-6 random words:

• Example: timber-pencil-orbital-cactus
• Entropy: ~55-80 bits (4 words from a large dictionary)
• Advantage: Much easier to type and remember than x7#Km9$vQ2&nR4pL
• Generate passphrases: Bitwarden and 1Password both have passphrase generators. Our tool generates random character strings, not passphrases.

What NOT to Use as a Password

• Your name, spouse's name, child's name, pet's name
• Your birthday, anniversary, or any personal date
• Your address, phone number, or zip code
• Any word from any dictionary in any language
• Keyboard patterns (qwerty, asdf, zxcv, 1qaz2wsx)
• Sports teams, movie quotes, song lyrics
• Any password you've used before on any other account

Security Tools

• Password Generator — create random passwords
• Password Strength Checker — test any password's entropy
• Hash Generator — SHA-256, MD5, and more