How to create a strong password

A strong password is long, random and used on only one site. The fastest way to get one is the FernTool password generator, which creates it on your device.

Length beats complexity

Attackers guess passwords with software that tries billions of combinations, starting with common words, names, dates and known leaked passwords. Swapping “a” for “@” doesn’t fool them. What does work is randomness and length: each extra random character multiplies the guesses needed. Current NIST guidance (SP 800-63B) focuses on length and screening against breached passwords rather than forced symbols or regular changes.

12+ characters for ordinary accounts.
16+ characters for email, banking and your password manager.
A random 16-character mix of letters and digits is about 95 bits of entropy: out of reach for any realistic attack.

Passphrases for passwords you must type

For a computer login or password-manager master password, use 4–6 randomly chosen words, like crane-velvet-orbit-mango-tidal. Pick them randomly (dice or a generator), not a song lyric or quote.

Never reuse a password

Most account takeovers come from “credential stuffing”: a password leaks from one site and criminals try it everywhere else. Check whether your email has appeared in a breach at haveibeenpwned.com, and change any reused password, starting with email, because email resets everything else.

Use a password manager

Nobody can memorise 100 random passwords. A password manager (for example Bitwarden, 1Password, NordPass or the one built into your browser or phone) generates, stores and fills them. You remember only the master password.

Turn on two-factor authentication

Two-factor authentication (2FA) stops most attacks even if your password leaks. An authenticator app or passkey is stronger than SMS codes, which can be stolen through SIM swaps.

Frequently asked questions

How long should a strong password be?

At least 12 characters, and 16 or more for important accounts. Length matters more than symbols.

Is it safe to use an online password generator?

Yes, if it generates in your browser with crypto.getRandomValues and sends nothing to a server, as FernTool’s does.

Should I change my passwords regularly?

Not on a schedule. Change a password when a site is breached or you suspect it’s known. Forced regular changes lead to weaker, predictable passwords.