How to Create a Strong Password: Length, Character Types, and Management
Many people assume that adding symbols makes a password safe, but the biggest factor in password strength is length, not character types. This guide compares the real number of combinations, lists the patterns to avoid, and covers how to manage passwords once you have created them.
Length matters more than character types
The number of combinations a brute-force attack has to try is “number of possible characters to the power of the password length”. Adding character types makes the base bigger, but adding length makes the exponent bigger. The key point is that the exponent has a far stronger effect.
| Character set | 8 characters | 12 characters | 16 characters |
|---|---|---|---|
| Lowercase only (26) | about 2×10^11 | about 9×10^16 | about 4×10^22 |
| Upper + lower + digits (62) | about 2×10^14 | about 3×10^21 | about 5×10^28 |
| Upper + lower + digits + symbols (94) | about 6×10^15 | about 5×10^23 | about 4×10^31 |
Reading the table across, going from 8 to 12 characters adds roughly 7 orders of magnitude to the number of combinations. Reading down, “adding symbols” adds only about 2. Making a password 4 characters longer is far more efficient than adding symbols that make it harder to remember.
Ways of creating passwords to avoid
Attackers do not rely only on pure random brute force. They try the patterns people tend to use first, so the following approaches are weak for their length.
- Using a dictionary word as is (Password, baseball, and so on)
- Simply swapping letters for symbols (p@ssw0rd and similar). These substitution rules are already built into cracking tools
- Information that can be guessed from social media: birthdays, phone numbers, company names, pet names
- Keyboard patterns (qwerty, 1qaz2wsx, and so on)
- Reusing one base and just adding the service name at the end (base + amazon, base + google)
- Periodic changes that only change the trailing number (Spring2025! → Summer2025!)
The last two, in other words reuse, are the most dangerous. Attacks that take passwords leaked from one service and try them on other services one by one (credential stuffing) happen all the time. However strong a password is, if you reuse it, one leak breaks all of those accounts in a chain.
Recommended settings by use case
| Use | Length | Characters | Notes |
|---|---|---|---|
| Email, cloud, banking | 16–20 characters | Upper + lower + digits + symbols | Set up two-factor authentication first |
| Typical web services | 12–16 characters | Upper + lower + digits | Many sites reject symbols |
| Sites that don’t allow symbols | 16+ characters | Upper + lower + digits | Make up for fewer character types with length |
| PIN / passcode | 6+ digits | Digits only | Avoid birthdays and sequences |
| API keys / tokens | 32 characters | HEX (0-9a-f) | Follow the system’s requirements |
Restrictions such as “no symbols allowed” or “16 characters maximum” are still common. When character types are limited, the basic rule is to use the maximum length within what is allowed.
Don’t make one up: generate it
Passwords that people make up are not as random as they think. Unconscious habits creep in, such as alternating vowels and consonants or picking something catchy. If you want real strength, the practical approach is to let a generator create the password and let a password manager remember it.
- 1
Choose a preset that fits the use
Pick one that matches the site’s requirements, such as Strong, Alphanumeric, PIN, or HEX. For sites that reject symbols, the Alphanumeric preset is the safe choice.
- 2
Adjust the length
As a rule, go up to the site’s maximum. If there is no limit, aim for 16–20 characters.
- 3
Generate several candidates and pick one
Choosing from several candidates lets you avoid ones with easily confused characters (I, l, 1, O, 0).
- 4
Save it in a password manager
Save it right after you generate it. The browser’s built-in password saving or a dedicated manager app are both fine. “I’ll memorize it later” never works.
Managing passwords and two-factor authentication
A strong password is pointless if it is managed poorly. In practice, these three points are enough.
- Use a different password for every service. This is the single most effective measure
- Use a password manager and memorize only the master password
- Turn on two-factor authentication (an authenticator app or passkeys) for important accounts
Regular password changes were once widely recommended, but major guidelines no longer actively recommend them. Forcing periodic changes pushes people toward weak patterns like changing only the last digit. You need to change a password when there are signs of a leak, and when you are cleaning up passwords you have been reusing.
FAQ
- How many characters should a password be?
- Use at least 12 characters for ordinary services, and at least 16 for important accounts such as email, cloud storage, and banking. On sites that do not allow symbols, make up for it with extra length.
- If I include symbols, is a short password OK?
- Not recommended. Going from 62 to 94 character types by adding symbols increases the number of combinations by only about 2 orders of magnitude. Going from 8 to 12 characters adds roughly 7. Prioritizing length is much more efficient.
- Do I need to change my passwords regularly?
- Unless there are signs of a leak, regular changes are not necessary. Forced periodic changes lead to simple patterns, so major guidelines no longer recommend them. Stopping password reuse matters far more.
- How should I store a generated password?
- Saving it in a password manager or your browser’s password storage is the practical choice. Save it right after generating it, and do not leave it in plain text on paper or in a text file.
Tools in this article
Related articles
How to Do a Traffic Count: Vehicle Classes, 15-Minute Tally Sheets, and Heavy Vehicle Percentage
“How many vehicles use this road per hour?” “When is the morning peak?” “How many trucks are in the mix?” Traffic counts are used for road planning, choosing store locations, student research projects, and neighborhood school-route safety work. But when you try one yourself, it is easy to get stuck on how to classify vehicles, where to count, how to build a 15-minute table, and how to calculate the peak hour and heavy vehicle percentage. This guide walks through preparation, counting on the day, building the tally sheet, calculating the peak hour, heavy vehicle percentage, and passenger car equivalents, running a pedestrian count, and recording on a phone tally counter and exporting to CSV, all with worked numbers.
Read article →How to Find the BPM of a Song: Tap Tempo Tips and Telling Double-Time from Half-Time
Transcribing by ear, practicing a dance, mixing as a DJ, cutting a video to the beat, setting a delay: all of these start with knowing the song’s tempo (BPM). But when you tap along a few times, the number changes every time, or the result comes out as double or half the real value. This guide covers what BPM means, how to keep tap-tempo error small, how to count with a clock, how to check with a DAW or app, how to tell double-time from half-time, and typical BPM ranges by genre and by tempo marking.
Read article →How to Test for Stick Drift: Check PS5, Switch, and Xbox Controllers with Numbers
Your character slowly starts walking on its own, or the camera keeps turning. When that happens, stick drift is the first suspect. But just by watching, it is hard to tell whether you are imagining it, whether it is a game setting, or whether the controller is actually faulty. This guide shows how to read your stick values in a browser and confirm drift with numbers, what the 0.05, 0.10, and 0.20 thresholds mean, how to read the drift direction and jitter, what to do if the controller is not detected, and how to use your results when asking for a repair.
Read article →