How to Create a Strong Password (and Remember It)

The three rules that actually matter

1. Length. Every extra character multiplies the work for an attacker. Aim for 16+ characters, 20+ for your email and bank.
2. Randomness. Humans are predictable. Cracking tools try dictionary words, names, dates, keyboard walks (qwerty) and common substitutions (@ for a) first.
3. Uniqueness. One password per site. Reuse turns a single breach into access to all your accounts — this is called credential stuffing.

Why “P@ssw0rd2026!” is weak

It ticks every complexity box — uppercase, lowercase, number, symbol — yet it is among the first guesses any cracking tool makes. Complexity rules produce predictable patterns: a capital at the start, a number and symbol at the end. Real strength is measured in entropy: how many equally likely possibilities an attacker must search.

Two good ways to build a password

1. Let a generator do it (best for everything you don’t type)

For the hundreds of accounts you only open through a password manager, use a random 20-character password. You never need to remember it. Try our free password generator — it runs entirely in your browser.

2. Use a random passphrase (best for the few you type)

For your master password and device logins, pick five to seven words at random — with dice or a generator, not from a favourite song. Join them with a separator. A passphrase like orbit-candle-maple-hollow-river-quiet is long, strong and surprisingly easy to remember.

Mistakes to avoid

• Personal information: names, birthdays, phone numbers, pet names, team names.
• Small changes to an old password (Password1 → Password2).
• Writing passwords in notes apps, spreadsheets or email drafts.
• Sharing passwords over chat or SMS — use secure sharing instead.
• Relying on a password alone: turn on two-factor authentication.

Check if a password was leaked

Even a strong password is useless once it appears in a breach. Lockvero’s password health report checks your saved passwords against known breaches using k-anonymity: only the first five characters of a hash leave your device, so nobody learns the password itself.

The easiest way to follow every rule

Nobody can remember a hundred unique random passwords. A password manager remembers them for you and fills them in on the right site. You only need one strong master passphrase.