Weak and reused passwords are behind a huge share of hacked accounts. The reassuring part is that protecting yourself doesn't require any technical skill — just a few simple habits. Here's what actually makes a password strong, and how to create good ones without straining your memory.

Length matters more than complexity

For years we were told to use a "complex" password with a capital letter, a number and a symbol. That advice isn't wrong, but it misses the bigger point: length is what really makes a password hard to crack. Each extra character multiplies the number of possible combinations, so a long password is exponentially tougher than a short "clever" one.

Compare these two: P@ss1! looks complex but is only six characters, and a computer could try every combination very quickly. A 16-character password, even a fairly plain one, has so many possibilities that guessing it by brute force is effectively impossible with today's technology. Aim for at least 16 characters on important accounts.

Never reuse a password

The second golden rule: use a different password for every account. Here's why it matters so much. When a website suffers a data breach — and big ones happen regularly — the leaked passwords get tried automatically against other sites. If you used the same password on your email, your bank, and that breached forum, one leak unlocks all of them. Unique passwords contain the damage to a single account.

Mix character types (but don't obsess)

Combining uppercase and lowercase letters, numbers and symbols does expand the pool of possibilities, so it's worth doing — especially for shorter passwords. But don't rely on complexity alone to rescue a short password. A long, unique password with a good mix of characters is the ideal.

How to actually manage all this

Nobody can remember dozens of long, random passwords — and you shouldn't try. The practical approach is:

• Generate a long, random password for each account.
• Store them in a reputable password manager, which remembers them for you and fills them in automatically.
• Remember just one strong master password for the manager itself.

To generate the passwords, use a tool that relies on genuine cryptographic randomness rather than something predictable. Our free password generator does exactly that — it uses your browser's secure random number generator, lets you set the length and character types, shows a strength meter, and never sends the password anywhere. You copy it straight into your password manager.

A few extra tips

• Turn on two-factor authentication wherever it's offered — it's a powerful second layer even if a password leaks.
• Be wary of "security questions" — treat the answers like passwords, since real answers are often easy to find.
• Change a password immediately if a service tells you it's been part of a breach.

Strong, unique passwords are the cheapest and most effective security upgrade most people can make. Generate them, store them, and stop worrying.