How to Create a Strong Password You Will Not Forget

Length matters more than complexity

Each extra character multiplies the work an attacker needs to guess a password. A random 16-character password is vastly harder to crack than an 8-character one full of symbols. Guidance such as NIST SP 800-63B emphasises length and screening against known-breached passwords rather than forcing arbitrary character rules.

Never reuse a password

When a website is breached, attackers try the leaked email and password on other popular sites. This is called credential stuffing, and it works because people reuse passwords. If every account has a different password, one breach stays one breach.

Remembering dozens of unique passwords is not realistic, which is exactly the job a password manager does.

Two good ways to build a password

For accounts you type often, such as your computer login or your password manager's master password, use a passphrase: four or more unrelated words, for example from a random word list. It is long, easy to remember, and hard to guess.

For everything else, let a generator create a random string. Padlock's generator uses crypto.getRandomValues, the browser's cryptographically secure random source, with a length slider and a live strength meter.

What to avoid

These patterns are the first things attackers try:

• Names, birthdays, pet names, or anything findable on social media.
• Simple substitutions like P@ssw0rd, which cracking tools already expect.
• Keyboard patterns such as qwerty123 or 123456.
• The same base word with a number that changes for each site.

Add a second factor

Even a strong password can be phished. Turn on two-factor authentication wherever it is offered. Time-based one-time codes are a good default, and Padlock can generate them for you alongside the saved login.