How to Create a Strong Password You Can Actually Manage

A strong password is long, random and used for only one account. Length matters more than mixing in symbols: a 16-character random password, or a passphrase of five or six random words, is far harder to crack than an 8-character jumble like P@ssw0rd!. The way to manage dozens of these is a password manager, so you only need to remember one strong master passphrase.

To make a random password right now, use our password generator. It creates passwords on your own device using the browser's secure random number generator.

Length vs complexity

For years, websites demanded "one uppercase, one number, one symbol". People responded predictably: Password1!, Welcome@123, India@2026. These meet the rules but are among the first guesses attackers try.

Current guidance has moved away from this. The US National Institute of Standards and Technology (NIST), whose digital identity guidelines are widely followed, published the final version of SP 800-63B revision 4 in 2025. Its main points for passwords are:

• Minimum 15 characters when a password is the only authentication factor (8 when used with another factor, such as an OTP).
• Systems should allow long passwords, at least 64 characters.
• No forced composition rules like "must include a symbol".
• No forced regular password changes, only a change when there is evidence of compromise.
• Passwords should be checked against lists of known breached and common passwords.

The idea is simple. Every extra character multiplies the number of possible passwords, so length adds far more strength than swapping an "a" for "@".

Three ways to make a strong password

1. A random password from a generator

Best for accounts stored in a password manager, because you never need to type it from memory.

• Use 16 to 20 characters or more.
• Include letters, numbers and symbols if the site allows them.
• Generate it with a proper tool, such as the password generator, not by "typing randomly", which humans are bad at.

2. A passphrase of random words

Best for the few passwords you must remember: your password manager's master password, your laptop login, your main email.

• Pick five or six words at random, for example by rolling dice against a word list (the "Diceware" method) or using a generator.
• Example of the style (do not use this one): orbit-velvet-candle-harbour-mango.
• Add separators or a number if a site requires it.

The words must be truly random. "ilovemydog" or a line from a song is easy to guess, because attackers use dictionaries of phrases and lyrics.

3. A long sentence you can remember

If you cannot use a generator, a long, unusual sentence is better than a short complex word: My neighbour's cat hates Tuesday rain 7 times. It is weaker than random words, because sentences follow grammar, but it is much stronger than Raj@1990.

What about the home Wi-Fi password?

People often keep a weak Wi-Fi password because guests have to type it. Use a long random one anyway, and share it with a printed code from the QR code generator using the standard Wi-Fi text format (WIFI:T:WPA;S:network-name;P:password;;), which most phone cameras can join directly. Keep that printout inside your home.

Why reuse is the real danger

Most account takeovers today do not involve anyone guessing your password. They come from reuse. When one website is breached, attackers try the same email and password on email, banking, shopping and social media accounts. If you reused it, they are in.

So the single most important rule is: every account gets its own password. That is impossible to manage from memory, which is why a password manager matters.

How to use a password manager

A password manager stores all your passwords in an encrypted vault, fills them in for you, and generates new random ones.

1. Choose a reputable manager. Your phone or browser's built-in manager is a reasonable start. Dedicated apps add features like secure sharing and breach alerts.
2. Create a strong master passphrase using five or six random words. This is the one password you memorise.
3. Turn on two-factor authentication for the manager itself.
4. Change your most important passwords first: email, banking, UPI and payment apps, phone account, and cloud storage. Your email matters most because it can reset everything else.
5. Replace the rest over time as you log in to each site.
6. Save your recovery codes somewhere safe offline.

Add a second layer: two-factor authentication

Even a perfect password can be phished. Turning on two-factor authentication (2FA) means a stolen password alone is not enough. In order of strength:

• Passkeys or hardware security keys resist phishing best, where available.
• Authenticator app codes are a good, free option.
• SMS OTP is weaker, as SIMs can be swapped, but is still much better than nothing.

Many services now offer passkeys, which replace the password with a key stored on your device and unlocked by fingerprint, face or PIN. Where offered, they are worth turning on.

How to check if a password has leaked

Breach-checking services can tell you whether your email or a password has appeared in known breaches, and many password managers do this automatically. Some checkers use a hashing technique so the full password never leaves your device. If you are curious how hashing works, you can experiment with the SHA-256 hash generator, but never paste your real passwords into websites you do not trust.

If a password has leaked, change it everywhere you used it, and turn on 2FA for that account.

Common mistakes

• Reusing one "strong" password everywhere. One breach exposes all accounts.
• Personal details in passwords: names, birthdays, phone numbers, cricket teams. These are easy to find on social media.
• Predictable substitutions like @ for a and 0 for o. Attackers' tools try these automatically.
• Adding a number at the end when forced to change (Summer2025, Summer2026).
• Writing passwords in a notes app or WhatsApp chat to yourself. Use a password manager instead.
• Sharing OTPs. No bank or genuine support agent needs your OTP or password.

Make one memorable passphrase, let a password manager handle the rest, and switch on 2FA. That covers most of what protects an ordinary person online.

Questions