The Complete Guide to Creating Strong Passwords

The most common password in leaked databases is still 123456. Despite decades of awareness campaigns, password hygiene remains poor — with severe consequences for account security.

How Attackers Crack Passwords

Brute force attacks try every possible combination — a 6-character lowercase password falls in under a second on modern hardware. Dictionary attacks use compiled lists of common words and known passwords. Credential stuffing tests username-password pairs from one breach against hundreds of other services. The key insight: cracking difficulty increases exponentially with length and diversity.

What Makes a Password Strong

A strong password is: long (16+ characters), random (not based on words or patterns), diverse (uppercase, lowercase, numbers, symbols), and unique (never reused across accounts). A password like tr0ub4dor&3 follows patterns that modern crackers specifically exploit. A truly random 16-character string is exponentially harder.

The Length Factor

A random 8-character password with all character types: ~17 hours to crack at 100 billion guesses/second. A 12-character: 200,000 years. A 16-character: longer than the age of the universe. Length is the single most effective lever.

Generating Strong Passwords

UltraToolkit's Password Generator creates cryptographically random passwords in your browser — never transmitted anywhere. Set length to 16+, enable all character sets, confirm a Strong or Very Strong rating, then copy directly to your password manager.

Password Managers

The only realistic way to maintain unique strong passwords for every account is a password manager. Reputable options: Bitwarden (open source, free), 1Password, KeePass. Never store passwords in plain text files, spreadsheets, or email.

Two-Factor Authentication

Even a perfect password can be phished. Enable 2FA (authenticator app, not SMS) on every account that supports it — starting with email, financial accounts, and work systems.

What Makes a Password Actually Strong

Password strength is determined by entropy — the number of possible passwords of the same type that an attacker must try to guarantee finding yours. Entropy is measured in bits: each bit doubles the number of possibilities. A 6-character lowercase password has 26^6 = 308 million possibilities — about 28 bits of entropy, crackable in seconds on modern hardware. A 16-character random password using all character classes (uppercase, lowercase, digits, symbols) has approximately 95^16 = 4.4 × 10^31 possibilities — about 104 bits of entropy, computationally infeasible to brute force.

Length is the single most important factor in password strength. Adding one character to a password increases entropy by log2(charset_size) bits — approximately 6.5 bits for a full character set. This means each additional character multiplies the brute force time by approximately 90 (for a 95-character charset). A 12-character random password is 90 times harder to crack than an 11-character one. A 16-character password is 90^4 = 65 million times harder than a 12-character one. The practical implication: password length matters far more than character class requirements, which is why NIST's 2024 guidelines prioritise length over mandatory complexity.

Common Password Patterns That Fail Security Tests

Despite widespread awareness of password security, predictable patterns persist because they satisfy formal requirements (minimum length, character classes) while being practically weak. Substitution patterns — replacing letters with similar-looking characters (E→3, A→@, S→$, I→!) — are included in every modern password cracking dictionary. Password1! satisfies most complexity requirements and is one of the most commonly used passwords globally. Cracking tools test all substitution patterns systematically.

Keyboard patterns (qwerty, 12345, zxcvbn, qweasdzxc) are similarly included in cracking dictionaries. Sequential patterns (abc123, 1q2w3e4r) are tested. Common base words with numbers appended or prepended (password123, 123password, password2024) are extremely common in leaked credential databases and crack within minutes. Birthdates in various formats, pet names, family member names, and sports teams — any password derived from personal information — are vulnerable to targeted attacks that research the target individual before attempting access.

Password Manager Selection Guide 2024

The password manager market has consolidated around a few strong options. Bitwarden is the most recommended free option: open-source (independently auditable code), unlimited passwords, sync across unlimited devices, available for all platforms. Its free tier has no meaningful limitations for most users. 1Password is the preferred paid option for individuals and teams: excellent usability, strong sharing features, Travel Mode (hiding sensitive vaults when crossing borders), and Watchtower (alerts for weak, reused, or breached passwords). Both have received favourable independent security audits.

The browser-built-in options (Chrome Password Manager, iCloud Keychain, Firefox Lockwise) are adequate for users with a single-browser, single-ecosystem workflow. Their limitations: Chrome passwords are not easily accessible in Firefox; iCloud Keychain passwords are not easily accessible on Windows. For users who work across multiple browsers and operating systems — common for developers and digital professionals — a dedicated cross-platform manager is more practical than relying on browser-native solutions.

Organisational Password Policies That Work

Enterprise password policies have historically required characteristics that security research shows reduce rather than improve security: mandatory periodic rotation (every 90 days), complexity rules (must include uppercase, lowercase, digit, and symbol), and minimum length of 8 characters. NIST SP 800-63B, updated in 2024, replaces these with evidence-based guidelines: passwords should be at least 15 characters for human-generated passwords (no maximum below 64), periodic rotation should be required only when there is evidence of compromise (not on a calendar schedule), and complexity requirements should be replaced with screening against known compromised password lists.

Single Sign-On (SSO) reduces the password problem by eliminating most passwords. An organisation that implements SSO for all internal tools requires employees to have one strong master credential (the SSO identity) rather than dozens of individual service passwords. Combined with hardware MFA on the SSO account, this creates a high-security architecture that is also easier for employees to use. Password manager rollout for the remaining non-SSO credentials completes the picture.