Create strong, random passwords instantly.
Strength comes from unpredictability, and unpredictability comes from two things: how many characters are in play, and how long the password is. Length contributes far more than complexity.
Every additional character multiplies the number of possibilities by the size of the character set. A twelve-character password drawn from upper case, lower case, digits, and symbols has roughly 9512 possible values — a number large enough that brute force is not a realistic attack.
Which is why the old advice to substitute letters with symbols is mostly theatre. Turning "password" into "p@ssw0rd" adds almost nothing, because attackers apply exactly those substitutions automatically. A longer, genuinely random string beats a short clever one every time.
Very few passwords are cracked by trying every combination. The realistic threats are different.
Credential stuffing is the biggest one. When a service is breached, the leaked email and password pairs are tried against every other major site. Any password you reuse is only as safe as the least secure place you used it.
Dictionary and rule-based attacks work through common words, names, dates, and predictable mutations. Anything based on your life — a pet, a birth year, a favourite team — falls quickly.
Phishing bypasses password strength entirely by persuading you to type it into the wrong place. No amount of entropy helps against this, which is why two-factor authentication matters so much.
Use a password manager and let it generate long random strings you never see. You then need to remember exactly one strong passphrase, and every site gets a unique credential. If a service is breached, the damage stops there.
For the master password, a passphrase of four or five unrelated words is both memorable and extremely strong — substantially more resistant than a short string of symbols, and far easier to type.
Turn on two-factor authentication wherever it is offered, preferring an authenticator app or hardware key over SMS, since phone numbers can be hijacked. And stop routine forced password rotation: it pushes people toward predictable incremental changes, which is why most modern security guidance now advises against it.