How to create a strong password (and remember it)

A strong password is long, unpredictable, and unique to each account. Complexity rules (one symbol, one number) help less than people think — length and true randomness matter more. The goal is not a clever phrase you can recite forever; it is a secret you store safely and never reuse.

What “strong” actually means

• Length: aim for at least 14–16 characters for important accounts; longer is better when a password manager stores it for you. Each extra character multiplies the search space attackers have to try.
• Unpredictability: avoid dictionary words alone, birthdays, pet names, and keyboard walks like qwerty123. Attackers try those patterns first because they show up in breach lists.
• Uniqueness: never reuse a password across email, banking, or work logins. One breached site should not unlock everything else.

Why “clever” substitutions fail

Swapping letters for lookalike symbols (P@ssw0rd) feels creative, but it is a known pattern. Credential-stuffing tools and password-cracking wordlists include those substitutions by default. Slight variations of an old password — adding ! or the year — are almost as weak as full reuse. If a site forces periodic rotation, change to a fully new random string instead of tweaking the last character.

Passphrases made of four unrelated random words can be strong when the words are truly random and long enough. The failure mode is choosing famous quotes, song lyrics, or themed phrases that appear in public corpora. Random generation beats improvisation.

A simple workflow that works

1. Generate a long random password in your browser with a free password generator.
2. Save it in a reputable password manager — not a notes app synced everywhere without a vault.
3. Turn on two-factor authentication. Prefer an authenticator app or hardware key over SMS when the site offers it.
4. Only memorize a few master credentials (vault unlock, device PIN). Let the manager handle the rest.

Using a memorable base word safely

Some people want a readable chunk inside an otherwise random password so they can spot typos when typing on constrained devices. That trade-off is acceptable only if the random portion is still long, character sets are mixed, and the base word is not your name, company, or an obvious hobby keyword. Treat the base word as convenience — not as the source of strength.

GenShelf’s password generator runs locally in your browser, so the value you generate does not need to leave your device before you copy it into a manager. Prefer excluding lookalike characters when you will type the password by hand, and keep longer lengths when a manager autofills for you.

After a breach

If a service you use reports a leak, change that password immediately — and any other account where you reused it. Enable 2FA, review recovery emails, and check whether the breached address appears in reputable breach-notification tools. Do not wait for “later”; reuse is what turns one incident into many.