How to Create a Strong Password
Weak passwords are one of the most common causes of hacked accounts. The good news: with the right approach, you can protect your accounts reliably — without memorising complicated strings of characters.
What Makes a Password Strong?
A strong password has high entropy — a measure of its randomness and unpredictability. The higher the entropy, the longer it takes an attacker to crack it.
Key factors that increase security:
- Length: Every additional character multiplies the number of possible combinations exponentially
- Character variety: Uppercase and lowercase letters, digits, and symbols expand the character space
- Randomness: No dictionary words, no patterns like "1234" or "qwerty"
Common Mistakes to Avoid
Personal information
Birthdates, pet names, or favourite sports teams are easy to guess — especially if your social media profiles are public.
Reusing passwords
When a website is breached, attackers immediately try compromised credentials on other services (known as "credential stuffing"). Every account needs a unique password.
Patterns instead of randomness
Password123! technically meets most requirements — but attackers know these patterns and test them first.
Three Proven Methods
1. Classic random password
A password generated with crypto.getRandomValues() consisting of 20+ characters with uppercase and lowercase letters, digits, and symbols has over 130 bits of entropy. That translates to billions of years of cracking time — even with modern hardware.
Example: nX7!kQr3mVp9wL2$jY8t
2. Passphrase (Diceware)
A passphrase made of 5–6 randomly chosen words is often more secure than a short complex password — and far easier to remember.
Example: tiger-atlas-flower-window-coffee
With 5 words from a 7,776-word list, you get over 64 bits of entropy. Passphrases are explicitly recommended by security experts including NIST.
3. Use a password manager
The easiest path to strong passwords: a password manager (e.g. Bitwarden, 1Password, KeePass) generates and stores a unique, strong password for every account. You only need to remember one master password.
Understanding Entropy
| Method | Characters/Words | Entropy |
|---|---|---|
| 8-char classic | 8 | ~52 bits |
| 12-char classic | 12 | ~78 bits |
| 20-char classic | 20 | ~130 bits |
| 4-word passphrase | 4 | ~51 bits |
| 5-word passphrase | 5 | ~64 bits |
| 6-word passphrase | 6 | ~77 bits |
As a rule of thumb: at least 60 bits for regular accounts, 80+ bits for important accounts like email and banking.
Get Started Now
The pwgen.de generator creates all types directly in your browser — no password ever leaves your device. Choose your type, adjust the settings, and copy the result into your password manager.