My friend got her Instagram account hacked last month. Her password was her dog's name followed by her birth year. It took the attacker about 4 seconds — that's not an exaggeration, that's roughly how long a dictionary attack takes to crack "Bella2024."
Most people know their passwords are weak. They just don't know what "strong" actually means or how to create passwords they can remember without writing them on a Post-it stuck to their monitor. Let's fix both of those problems.
What makes a password strong?
Password strength comes down to one thing: how long it would take an attacker to guess it. This is determined by:
Length
Length is the single most important factor. Each additional character multiplies the number of possible combinations exponentially.
- 8 characters: ~200 billion combinations (crackable in minutes with modern hardware)
- 12 characters: ~3 sextillion combinations (crackable in centuries)
- 16 characters: ~1 undecillion combinations (effectively uncrackable with current technology)
The minimum for any password in 2026 should be 12 characters. 16+ is better.
Character variety
Using only lowercase letters gives you 26 possible characters per position. Add uppercase, numbers, and symbols and you have 95 possible characters per position. That's a massive difference in total combinations.
- Lowercase only (8 chars): 208 billion combinations
- Mixed case + numbers + symbols (8 chars): 6.6 quadrillion combinations
Unpredictability
The biggest weakness in most passwords isn't length or character variety — it's predictability. Attackers don't try random combinations. They try:
- Common passwords — "password123", "qwerty", "letmein" (these get tried first)
- Dictionary words — every word in the English language with common substitutions (p@ssw0rd)
- Personal information — names, birthdays, pet names, anniversary dates (all available on your social media)
- Keyboard patterns — "qwerty", "asdfgh", "1qaz2wsx"
- Previously leaked passwords — billions of real passwords from data breaches are publicly available
The password "Tr0ub4dor&3" looks complex but follows a predictable pattern (dictionary word + common substitutions + symbol + number). A truly random password like "mK9$vP2xNq5!" is much harder to crack despite being the same length.
Three methods for creating strong passwords
Method 1: Random generator (strongest)
The most secure approach is letting a computer generate truly random characters. Use a random string generator to create passwords like:
Kx9#mP2$vQ7nL5@w
This is cryptographically strong and essentially uncrackable. The downside: it's impossible to memorize. This method works best paired with a password manager (which you should be using anyway — more on that below).
Method 2: Passphrase (strong + memorable)
A passphrase is 4-6 random words strung together:
correct horse battery staple
This famous example (from xkcd) illustrates the principle: four random words create a password that's easy to remember but has more entropy than a typical complex password. The key is that the words must be truly random — not a phrase you'd actually say.
How to make a good passphrase:
- Open a dictionary (or a random word generator) and pick 4-5 words at random
- Don't pick words that form a grammatical sentence
- Add a number and symbol somewhere for sites that require them
- The result looks like:
maple 7 quantum blanket !river
A 5-word passphrase has roughly 65 bits of entropy — equivalent to a 10-character random password. And you can actually remember it.
Method 3: Base word + transformation (moderate)
If you hate both of the above, this is the practical compromise:
- Pick a sentence you'll remember: "My first apartment was on 5th street in Brooklyn"
- Take the first letter of each word:
MfaWo5siB - Add a symbol and make it longer:
MfaWo5siB!2026
This is weaker than the other methods because it follows a pattern, but it's significantly better than "Brooklyn2024" and you'll actually remember it.
The password manager question
Here's my honest take: you should use a password manager. I resisted for years because it felt like putting all my eggs in one basket. But the alternative is using the same weak password everywhere, which is objectively worse.
A password manager lets you:
- Generate unique 20+ character random passwords for every site
- Auto-fill passwords so you never type them
- Store them encrypted behind one master password
- Sync across all your devices
Your master password is the one password you need to memorize. Make it a strong passphrase (Method 2 above). Everything else gets generated randomly.
Popular options: Bitwarden (free, open source), 1Password, or your browser's built-in manager (Chrome, Firefox, Safari all have one).
Common mistakes people make
Using the same password everywhere
When one site gets breached (and they do — regularly), attackers try your email and password on every other major site. If you use the same password for your email, your bank, and your social media, one breach compromises everything. This is called "credential stuffing" and it's the #1 way accounts get hacked.
"Clever" substitutions
Replacing 'a' with '@', 'e' with '3', and 'o' with '0' doesn't help. Attackers know about these substitutions and include them in their dictionaries. "P@ssw0rd" is cracked just as fast as "Password."
Adding "123" or "!" at the end
The most common password modification is appending numbers or a single symbol. Attackers know this and try it automatically. "MyPassword!" is barely harder to crack than "MyPassword."
Changing passwords too often
Counter-intuitively, forcing password changes every 90 days (a common corporate policy) actually makes passwords weaker. People respond by using predictable patterns: "Summer2026!", "Fall2026!", "Winter2027!". NIST now recommends against mandatory rotation — change passwords only when you have reason to believe they've been compromised.
How to check if your password has been leaked
Before creating a new password, check if your current one has already appeared in a data breach. The site "Have I Been Pwned" (haveibeenpwned.com) lets you check email addresses against known breaches. If your email appears, change the password on that site immediately — and on every other site where you used the same password.
Quick action plan
- Right now: Generate a strong master password using a string generator or the passphrase method
- This week: Set up a password manager and import your saved passwords
- Over the next month: Change passwords for your most critical accounts (email, bank, primary social media) to unique, generated passwords
- Ongoing: Use your password manager to generate a unique password for every new account
You don't need to change every password today. Start with the accounts that would hurt most if they were compromised — your primary email (it's the gateway to resetting every other password), your bank, and your most-used social media. Work through the rest gradually.
Tools
- Random String Generator — generate cryptographically random passwords of any length with customizable character sets
One strong, unique password per account. A password manager to remember them all. That's the entire system. It takes an afternoon to set up and protects you for years.