How to Write a Strong Password (and Why Passphrases Are Better)

Most advice about “strong” passwords focuses on the wrong thing: a mandatory capital letter, a digit, one special character. Those rules feel secure but often produce passwords that are both hard for a person to remember and not particularly hard for a computer to guess. This guide covers what actually determines password strength, and why a random passphrase frequently beats a traditional password on both security and memorability at once.

What “Strong” Actually Means: Entropy, Not Symbols

A password’s resistance to being guessed is usually described in terms of entropy, a measure of how many possible combinations an attacker would have to try before finding it. Entropy grows with two things: how many characters the password could have been drawn from, and how long the password is.

Here’s the part that surprises people: length increases entropy exponentially, while adding a new category of character, say, requiring one symbol, only multiplies it by a small, fixed amount. An eight-character password using letters, digits, and symbols has a large but bounded set of possible combinations. A sixteen-character password using only lowercase letters has vastly more, simply because there are so many more character positions to guess correctly. Complexity rules exist for a reason, but they’re a much smaller lever than length.

Why “P@ssw0rd1!” Isn’t Actually Strong

A password like P@ssw0rd1! technically satisfies most complexity requirements, an uppercase letter, a digit, a symbol, but it’s a poor password in practice for a reason entropy alone doesn’t capture: predictability. Attackers don’t guess randomly, they guess in order of likelihood, starting with dictionary words, common substitutions (@ for a, 0 for o), and known-leaked passwords from previous breaches. A password that looks complex but follows a common, guessable pattern gets tried early, not late.

True randomness matters as much as raw length. A password generated by actually rolling dice, or the equivalent electronic process, doesn’t follow a pattern an attacker can anticipate, even a short one is meaningfully harder to guess than a longer password built from a predictable substitution pattern.

Why Passphrases Win on Both Security and Memorability

A passphrase strings together several random, unrelated words, something like correct horse battery staple, rather than a single word or short string. Assuming each word is chosen randomly from a large word list, the entropy math works out in the passphrase’s favor even though it’s easier to remember and type than a traditional password of comparable strength.

The reason is straightforward: a large word list (say, a few thousand common words) gives each word position roughly as many possibilities as several random characters would, but a whole word is far easier for a human brain to store and recall than an equivalent string of random characters. Four to six random words, drawn from a genuinely large list and genuinely randomly selected, routinely outperforms an eight-to-twelve-character traditional password while being noticeably easier to type correctly and remember without writing down.

The key word throughout is random. A passphrase made of words you personally chose, like a memorable sentence or song lyric, loses almost all of this advantage, because a human-chosen phrase is far more predictable than a computer-selected one, even if it feels random to you.

Strength Alone Doesn’t Solve Reuse

A password or passphrase being individually strong only protects against one category of attack: someone trying to guess or brute-force it directly. It does nothing to protect an account if the password was reused somewhere else that later suffered a data breach. Once a password leaks from one site, attackers automatically try that exact same password against other popular services, a technique known as credential stuffing, and a strong-but-reused password is exactly as vulnerable to this as a weak one.

This is why password strength and password uniqueness are two separate problems that both need solving, typically with the help of a password manager that can store a different strong password or passphrase for every account without asking you to memorize any of them.

Generating Passwords and Passphrases That Are Actually Random

Because true randomness is the ingredient that makes both approaches work, generating one by hand, picking “random-feeling” characters or words yourself, tends to produce something far less random than it feels. The Password & Passphrase Generator uses your browser’s cryptographically secure random number generator to produce either a traditional password with adjustable length and character sets, or a passphrase built from a large random word list, with nothing generated or logged server-side. If you also need a random unique identifier for something other than a login, like a database key, the UUID Generator covers that related but distinct use case.

The short version

A password’s real strength comes from length and genuine randomness, far more than from satisfying symbol-and-capital-letter rules, and a password that merely looks complex is often more predictable, and therefore weaker, than it appears. Random passphrases exploit this: stringing together several unrelated random words usually produces more entropy than a short complex password while being dramatically easier to remember and type. None of this replaces using a unique password or passphrase per account, since strength alone doesn’t protect against a password leaked from an unrelated breach.