Most "rules" about passwords are outdated. Swapping an a for @ does almost nothing against modern cracking. What actually protects you is length, unpredictability, and not reusing passwords. Here's how to build passwords that are strong and human-friendly.
Key takeaways
- Length beats complexity — aim for 16+ characters.
- A 4-word passphrase is strong and memorable.
- Use a unique password for every account.
- Let a password manager + 2FA do the heavy lifting.
Why length wins: entropy
Password strength is measured in entropy — the number of guesses needed to crack it. Each extra character multiplies the possibilities, so length adds strength far faster than swapping in a symbol. A 16-character password has astronomically more combinations than an 8-character one, even a "complex" 8.
An 8-character password with symbols can fall in hours. A 5-word passphrase could take centuries to brute-force.
The passphrase method
Pick four or more random, unrelated words and string them together:
copper-lantern-village-quiet
salmon7-drift-maple-thunderThese are long (high entropy) yet easy to picture. Avoid famous quotes, song lyrics, or predictable patterns — randomness is the whole point.
Generate a strong password instantly
Choose length and character types and get a secure random password — generated locally in your browser.
Open the Password Generator →The 4 habits that matter most
- Unique per site. Reuse is the #1 risk — one breach exposes every account that shares the password.
- Use a password manager. It stores long random passwords so you only memorise one master phrase.
- Turn on 2FA. A second factor blocks attackers even if a password leaks.
- Check for breaches. If a service is breached, change that password immediately.
What to avoid
- Names, birthdays, and
password123-style classics. - Reusing a "base" password with small tweaks per site.
- Predictable substitutions (
P@ssw0rd) — crackers know them all. - Sharing passwords over chat or email.
Frequently asked questions
What makes a password strong?
Length first — a long, unpredictable 16+ character password or passphrase beats a short complex one. Uniqueness per account matters just as much.
Are passphrases safe?
Yes — four or more random, unrelated words are memorable and very strong, as long as they aren't a famous phrase.
Should I use a password manager?
Yes — it lets you use a unique long random password everywhere while remembering just one master password.
Related tools
See our Disclaimer for how to use WorkIQ content and tools.