Key takeaways
- Password strength is mostly length: a 16-character password is billions of times stronger than an 8-character one, not merely twice as strong.
- Substituting symbols into a short word, such as turning password into P@ssw0rd!, barely helps because cracking software tries those substitutions first.
- Use at least 14 to 16 characters, ideally a passphrase of several random words, and never reuse a password across sites.
- A password manager holds every unique password behind one master passphrase, and two-factor authentication protects the account on the day a password leaks.
The strength of a password is mostly its length. Every character you add multiplies the number of guesses an attacker needs, so a 16 character password is not twice as strong as an 8 character one, it is billions of times stronger. Substituting symbols into a short word, turning password into P@ssw0rd!, barely helps, because cracking software tries exactly those substitutions first.
What actually gets accounts hacked
Attackers rarely guess passwords one by one against a login page. The common paths are simpler: a website gets breached and leaks its password list, and attackers try those leaked passwords on your other accounts, which is why reuse is so dangerous. Or software runs billions of guesses per second against a stolen database, mowing down every short and common password first. Short, reused passwords fall to both attacks. Long, unique ones survive both.
Two rules that cover almost everything
Rule one: make it long, at least 14 to 16 characters. A passphrase of several random words, like mango-turbine-quiet-lamp, is long, strong, and actually typeable on a phone. The words must be random though; a famous quote or song lyric is on every cracking list.
Rule two: never reuse a password across sites. Reuse converts one website's breach into a master key for your whole life. Every account gets its own password, no exceptions for the accounts you think do not matter, because the email account those "unimportant" sites can reset is the one that matters most.
The tools that make the rules practical
Nobody can memorize forty long unique passwords, and nobody has to. A password manager stores them all behind one strong master passphrase, the only password you memorize. For generating the passwords themselves, use a proper random generator rather than your imagination, because human chosen passwords follow patterns that cracking software knows well. The free Password Generator creates long random passwords in one click, and it runs in your browser.
Wherever a site offers two factor authentication, turn it on. It is the seatbelt that saves you on the day a password does leak.
The bottom line
Length first, uniqueness always, a manager to hold them, and two factor as backup. That combination puts you ahead of the attacks that actually happen, and it takes an afternoon to set up.