How to Create a Genuinely Strong Password
Security - 6 min read - Published 2026-08-27
Most password advice from the 2000s and 2010s - "use a mix of upper/lowercase, numbers, and symbols" - turned out to encourage weaker passwords in practice, not stronger ones. People responded to those rules predictably: capitalizing the first letter, adding "1!" at the end, substituting @ for a. Attackers know these patterns and check for them first.
Length Beats Complexity
Password strength against brute-force guessing is really about entropy - how many possible combinations an attacker has to search through. A random 8-character password with upper/lower/numbers/symbols has roughly 6.6 x 10^15 possible combinations. A random 16-character password using just lowercase letters has about 4.3 x 10^22 - millions of times more, despite being "simpler." Length scales entropy exponentially; adding character types scales it only linearly.
How Real Attacks Work
Attackers rarely brute-force truly random passwords character by character - it's usually not necessary. Most cracking success comes from credential-stuffing (trying passwords leaked from other breaches), dictionary attacks (trying real words and common patterns first), and targeted guessing based on personal information. A password that's long and genuinely random defeats all three, because there's no pattern or dictionary word to match against.
What "Random" Actually Means
This is where it gets technical in a way that matters: not all "random" is equal. JavaScript's Math.random(), which many password generators still use under the hood, is a pseudo-random number generator designed for speed, not unpredictability - it's not safe for anything security-related, because its internal state can sometimes be predicted or reconstructed. Cryptographically secure generators (using the browser's crypto.getRandomValues() API, for example) pull from an operating-system-level source of genuine entropy specifically designed to resist this kind of prediction.
Practical Recommendations
Use a password manager and let it generate long, random, unique passwords for every account - you don't need to remember them if you're not typing them from memory. For the handful of passwords you do need to remember (like your password manager's own master password), a passphrase of 4-6 random, unrelated words is both memorable and has far more entropy than most people expect from something they can actually recall.