To create a strong password, make it long, unpredictable and unique to one account, then let a password manager remember it and add a second login step wherever it is offered. Length matters more than clever symbols, and random choice matters more than anything you can invent by hand. This guide explains how to create a strong password, when a passphrase is a better fit, how password managers and two-factor authentication help, and what hashes and UUIDs are, and are not. It is general guidance, not a substitute for advice about your own situation.
What makes a password strong?
A strong password is hard to guess, long enough to resist automated guessing, and never reused on another site. Official guidance has moved away from complicated character rules and toward length and uniqueness.
The US standards body NIST publishes technical rules for services that handle logins in SP 800-63B. At the time of writing, that document says a password used as the only login factor should be at least 15 characters, and that services should allow at least 64 characters. It also says services should not force people to mix character types and should not require routine periodic changes unless there is evidence of compromise. It requires services to check new passwords against lists of commonly used or compromised ones, and to allow password managers and pasting.
The US Cybersecurity and Infrastructure Security Agency makes similar points for the public in its Secure Our World guidance on strong passwords: use long, random and unique passwords, and use a password manager to handle them. Check the page itself for the current length recommendation.
In practice, that gives four properties to aim for:
- Long. Every extra character multiplies the number of guesses an attacker needs.
- Random. Predictable choices such as names, dates and keyboard patterns are tried first.
- Unique. If one site leaks your password, attackers try it on other sites.
- Not a known password. Anything that has appeared in a breach list is weak regardless of length.
How do you create a strong password in practice?
The simplest method is to generate one randomly instead of inventing it. Humans are poor at randomness, and leetspeak substitutions such as swapping “o” for “0” add very little because attackers know those tricks. The UK National Cyber Security Centre makes the same point in its three random words advice.
A free Password Generator that runs in your browser can produce a random string once you press the button. Choose a length of at least 16 for ordinary accounts, and longer for important ones such as email, if the site allows it. Then store the result in a password manager rather than memorizing it.
Some quick arithmetic shows why length wins. A random 12 character password drawn from all 94 printable ASCII characters has 94 to the power of 12 possibilities, about 4.8 times 10 to the 23rd, or roughly 78.7 bits of strength (computed with Python). Stretching the same pool to 16 characters gives roughly 104.9 bits. These numbers only hold if every character is chosen at random. A 12 character password built from a pet name and a year is far weaker than its length suggests.
What is a passphrase and when should you use one?
A passphrase is a password made of several random words. Use one for the few secrets you must type from memory, such as your password manager’s master password or your device login.
The NCSC recommends combining three random words, giving the example “applenemobiro” on its page, and explains that this is long enough while still being memorable. The words must be random. A famous quote or song line is not random and is easier to guess.
The strength depends on the size of the word list and the number of words. With a list of 7,776 words, as used by dice-based methods, each random word adds about 12.9 bits. Python gives roughly 51.7 bits for four words, 64.6 for five and 77.5 for six. For an important master password, more words is a cheap way to add safety, and six random words is a common choice. To choose words fairly, you need a real source of randomness, such as dice or the Random Number Generator to pick positions in a word list. Choosing words that “feel” random does not count.
Passwords versus passphrases
| Type | Example style | Best for | Weak point |
|---|---|---|---|
| Random password | 20 characters from a generator | Everything stored in a password manager | Hard to type or remember |
| Random passphrase | Several unrelated words | Master password, device login | Weak if the words are chosen by you or related |
| Human-made password | Name plus year plus symbol | Nothing | Predictable and often already leaked |
| Reused password | Same one on many sites | Nothing | One breach exposes every account |
Why use a password manager?
A password manager creates and stores a different long random password for each account, so you only need to remember one strong master password. This is the practical answer to the problem that nobody can memorize dozens of unique passwords. Both CISA and the NCSC describe password managers as a sensible option, and NIST’s rules require login services to allow them.
Some points to consider when choosing one:
- Pick a well-established product with a published security approach, and read its own documentation.
- Protect the vault with a long passphrase and turn on two-factor authentication for it.
- Keep a safe recovery method, because losing the master password can mean losing the vault.
- Keep the app and your devices updated.
The NCSC page also says that writing passwords down is acceptable if the paper is kept somewhere safe. That is better than reusing one password everywhere.
What is two-factor authentication and why does it matter?
Two-factor authentication (2FA) asks for something beyond your password, such as a code or a physical key, so a stolen password alone is not enough to get in. It is one of the most useful single steps you can take, particularly for email, banking and your password manager.
CISA lists multifactor authentication as one of its core actions for staying safe online. Methods differ in strength:
- Security keys and passkeys. These resist phishing because they only work with the genuine site. NIST’s current guidance puts a lot of emphasis on phishing resistant methods.
- Authenticator app codes. Time-based codes generated on your phone are a solid everyday choice.
- Text message codes. Better than nothing, but they can be intercepted or redirected through SIM swapping, so prefer an app or key where you can.
Save backup codes in a safe place when you enable 2FA. Never read a login code to anyone who contacts you, because real services do not ask for it.
What is a hash, and is it the same as encryption?
A hash is a fixed-length fingerprint of some input, produced by a one-way function. It is not encryption, because you cannot turn the fingerprint back into the original data. The same input always gives the same hash, and a tiny change gives a completely different one.
Python’s SHA-256 of “hello” begins with 2cf24dba5fb0a30e, while “hello!” gives ce06092fb948d9ff at the start, with no visible relationship. You can experiment with the Hash Generator, which shows the digest after you press the button.
What hashes are used for
- Checking file integrity. Compare a published hash with the hash of your download to see whether the file changed.
- Storing passwords. Services should store a salted hash, not your actual password. NIST requires passwords to be salted and hashed with a suitable password hashing scheme.
- Detecting duplicates and changes. The same content gives the same fingerprint.
What hashes are not
- Not a way to hide a weak password. Attackers guess common passwords, hash each guess and compare. A weak password falls quickly even when hashed.
- Not all equal. Fast general hashes like MD5 and SHA-256 are poor choices on their own for storing passwords. Purpose-built, deliberately slow password hashing is the right tool, and that is a job for developers of the service, not for you.
- Not reversible. If a website can email you your original password, it stored it badly.
What is a UUID, and is it a secret?
A UUID (universally unique identifier) is a 128 bit label, usually written as 32 hexadecimal characters in five groups, used to give records and objects unique names. It is an identifier, not a password. The standard is RFC 9562.
A version 4 UUID is generated from random numbers, with 122 random bits once the fixed version and variant bits are set. That is about 5.3 times 10 to the 36th possible values, so accidental duplicates are extremely unlikely. A tool such as the UUID Generator can create them for testing or development.
Uniqueness is not the same as secrecy. The RFC says UUIDs should not be assumed to be hard to guess, and should not be used as security capabilities. Some versions embed a timestamp, and even a random one may come from a weak generator. If a link or a record needs to be unguessable, use a purpose-built secure random token and proper access checks, not just a UUID in a URL.
A short comparison of the four ideas people confuse:
| Item | What it does | Reversible? | Safe as a secret? |
|---|---|---|---|
| Password | Proves who you are | Not applicable | Yes, if strong and private |
| Hash | Fingerprints data | No | No, it only checks equality |
| UUID | Labels a thing uniquely | Not applicable | No, it is an identifier |
| Encoded text (such as Base64) | Changes format | Yes, by anyone | No |
What are the most common password and security mistakes?
The biggest mistakes are reuse, predictability and skipping the second factor. Fixing these three covers most everyday risk.
- Reusing passwords. One leak then opens many accounts. Give every account its own.
- Using personal details. Names, dates of birth, pets and teams can often be found on social media, as the NCSC notes.
- Trusting simple tricks. Adding “1!” or swapping letters for digits does little.
- Changing passwords on a schedule for no reason. NIST’s rules say services should not require periodic changes, but you should change a password immediately if you suspect it has been exposed.
- Skipping 2FA on email. Your email account can reset almost everything else, so protect it first.
- Entering passwords on links from messages. Go to the site yourself instead of following a link in an unexpected email or text.
- Treating hashes, UUIDs or encoded text as secrets. None of them keep information private.
- Ignoring recovery options. Keep recovery email, backup codes and phone numbers current.
Frequently asked questions
How long should a strong password be?
For a login that relies on the password alone, NIST’s current document sets a minimum of 15 characters for services. For your own accounts, a random password of 16 characters or more from a generator is a reasonable target, and longer for key accounts.
Do I need special characters and numbers?
Not necessarily. NIST says services should not impose mixing rules. A long random passphrase can beat a short password full of symbols. Some sites still demand symbols, so a generator that allows them is handy.
Is it safe to use a password generator?
Yes, if it uses a proper random source and does not send what it creates to a server. Tools that run in your browser avoid sending the result anywhere, but still copy it straight into your password manager.
Is a password manager safe to rely on?
Government agencies recommend them for ordinary users, because they remove reuse. Protect the vault with a strong passphrase and 2FA, and keep recovery details safe.
Are text message codes good enough for 2FA?
They are far better than no second factor. If your account supports an authenticator app, passkey or security key, those are stronger choices against phishing and SIM swapping.
Can I use a UUID as a password or access token?
No. A UUID is built to be unique, not secret, and the standard warns against treating it as a security capability. Use a dedicated secure random token generated by a cryptographic library.
Where to start today
Begin with your email and your password manager: give each a long unique passphrase and turn on 2FA. Then work through other accounts, replacing reused passwords with generated ones as you go. Browse our other free tools if you need more helpers. This is general information and does not replace professional security advice.
Free Tools Mentioned in This Guide
See all of them on the free online tools page.