How to create a strong password (and remember it)

A strong password is long, unpredictable, and unique to each account. Complexity rules (one symbol, one number) help less than people think — length and true randomness matter more. The goal is not a clever phrase you can recite forever; it is a secret you store safely and never reuse.

What “strong” actually means

• Length: aim for at least 14–16 characters for important accounts; longer is better when a password manager stores it for you. Each extra character multiplies the search space attackers have to try.
• Unpredictability: avoid dictionary words alone, birthdays, pet names, and keyboard walks like qwerty123. Attackers try those patterns first because they show up in breach lists.
• Uniqueness: never reuse a password across email, banking, or work logins. One breached site should not unlock everything else.

Why “clever” substitutions fail

Swapping letters for lookalike symbols (P@ssw0rd) feels creative, but it is a known pattern. Credential-stuffing tools and password-cracking wordlists include those substitutions by default. Slight variations of an old password — adding ! or the year — are almost as weak as full reuse. If a site forces periodic rotation, change to a fully new random string instead of tweaking the last character.

Passphrases made of four unrelated random words can be strong when the words are truly random and long enough. The failure mode is choosing famous quotes, song lyrics, or themed phrases that appear in public corpora. Random generation beats improvisation.

A simple workflow that works

1. Generate a long random password in your browser with a free password generator.
2. Save it in a reputable password manager — not a notes app synced everywhere without a vault.
3. Turn on two-factor authentication. Prefer an authenticator app or hardware key over SMS when the site offers it.
4. Only memorize a few master credentials (vault unlock, device PIN). Let the manager handle the rest.

How GenShelf’s strength label is scored

The meter on the password generator is a reminder, not a lab measurement. It adds a point at 12, 16, and 20 characters, another when three character sets are enabled, and another when all four sets are on and length is at least 12. It does not subtract for a dictionary base word, and it does not compute entropy in bits. If you use a memorable root, judge strength by length and uniqueness — not by a green label alone.

Generate locally, then store in a vault

A generator that runs in your browser with crypto.getRandomValues does not need to see the password after you copy it. That is the point of GenShelf’s password generator: length, character sets, optional base word, optional leetspeak, and lookalike exclusion — all on-device. The generator is not a vault. If you leave the tab and lose the clipboard, the secret is gone unless you already saved it in a manager.

Exclude lookalikes when you will type on a TV, a router sticker, or a shared Wi‑Fi card. Keep the full character set when a manager autofills. Sixteen characters with mixed sets is a solid floor for important accounts; go longer when the site allows it and a vault is doing the remembering.

Using a memorable base word safely

Some people want a readable chunk inside an otherwise random password so they can spot typos when typing on constrained devices. That trade-off is acceptable only if the random portion is still long, character sets are mixed, and the base word is not your name, company, or an obvious hobby keyword. Treat the base word as convenience — not as the source of strength.

GenShelf’s password generator runs locally in your browser, so the value you generate does not need to leave your device before you copy it into a manager. Prefer excluding lookalike characters when you will type the password by hand, and keep longer lengths when a manager autofills for you.

After a breach

If a service you use reports a leak, change that password immediately — and any other account where you reused it. Enable 2FA, review recovery emails, and check whether the breached address appears in reputable breach-notification tools. Do not wait for “later”; reuse is what turns one incident into many.

For how generators and vaults split the work, read password managers vs password generators.