Most advice about passwords is stuck in the past, all forced symbols and quarterly changes. What actually keeps an account safe is simpler and, once you understand why, easier to live with. Here is how attackers really crack passwords, and what to do about it.
Length beats complexity
The strength of a password is roughly how many guesses an attacker would need. Each extra character multiplies that number far more than swapping an a for an @ does. A short password full of symbols like P@ssw0rd! is weak because it is short and follows a predictable pattern that cracking tools expect. A longer string, even of ordinary words, is exponentially harder.
This is why a four-word passphrase such as correct-battery-lamp-otter is stronger than a fiddly eight-character one, and you can actually remember it. Aim for at least 12 characters, and prefer 16 or more for anything important.
How passwords really get cracked
Attackers almost never sit typing guesses at a login box; rate limits stop that. Instead:
- Credential stuffing: they take username and password pairs leaked from one breached site and try them everywhere else. This is why reuse is the single biggest risk.
- Offline cracking: if a site's hashed passwords leak, they run billions of guesses per second against the hashes, starting with common passwords, dictionary words, and known patterns.
- Phishing: they simply trick you into typing it. No password strength helps here, which is why a second factor matters.
The three rules that matter
- Long and unpredictable. A random passphrase or a generated string, not a name, date, or keyboard pattern.
- Unique per account. So one breach cannot unlock the rest. This is impossible to do by memory across dozens of sites, which is what password managers are for.
- Two-factor where it is offered. Even a cracked password is useless without the second factor. Prefer an authenticator app over SMS.
When to let a generator do it
For the handful of passwords you must memorise (your device login, your password manager's master password), a passphrase you invent is ideal. For everything else, a random generated password stored in a manager is stronger and you never need to type it. Our password generator builds one using the browser's cryptographically secure random source, entirely on your device, and nothing is sent anywhere. Set the length to 16 or more, include the character types the site requires, and copy it straight into your manager.
The takeaway: stop memorising clever substitutions. Make the few passwords you need long and memorable, generate the rest, and never reuse one.