Password rules that demand a capital letter, a number and a symbol often produce passwords like Summer2026!, which attackers guess easily. What matters most is length and randomness.
Use length, not tricks
Every extra character multiplies the number of guesses needed. A random 16 character password is far stronger than a clever 8 character one. Four or five unrelated random words also make a strong, memorable passphrase.
Never reuse passwords
When one site leaks a password, attackers try it everywhere else. A password manager lets every account have its own long random password.
Turn on two-step verification
Even a leaked password is much less useful when a second factor is required. Prefer an authenticator app over text messages when you can.
Create random passwords locally with our password generator. It uses your browser's secure random source and sends nothing over the network.