How to Create a Strong Password
A strong password is unique, sufficiently long, and created with unpredictable random choices. Complicated-looking substitutions are not a substitute for randomness.
Start with a random generator
For passwords stored in a password manager, a randomly generated 20-character password using a mixture of character types is a convenient default. For a password you need to type from memory, a passphrase made from several independently random words may be more practical.
Avoid reuse
If a password is exposed in one breach, attackers may try it on unrelated accounts. Give every account its own password and use a reputable password manager to keep track.
Enable additional protection
Turn on multi-factor authentication or passkeys when available. These measures can reduce risk even when a password is compromised.
Understand strength estimates
Entropy estimates describe the number of random possibilities under specific assumptions. They do not predict actual breach outcomes, which also depend on phishing, malware, account recovery, and how websites store passwords.