How to Create Strong Passwords You Don’t Have to Remember
Most hacked accounts don’t fall to genius hackers — they fall to reused, short or predictable passwords. The fix is simple: long, random, unique passwords stored in a password manager. Here’s how to do it right.
Why random beats clever
“P@ssw0rd2026!” feels complex, but attackers’ tools try those substitutions first. A truly random 16-character password drawn from 94 characters has about 105 bits of entropy — billions of years to brute-force with today’s hardware.
How long should a password be?
- Everyday accounts: 14–16 random characters.
- Email, banking, password-manager master password: 20+ characters or a long passphrase.
- Wi-Fi and API keys: 24–32 characters.
Length matters more than symbols: every extra character multiplies the possibilities.
Generate safely
RandNow creates passwords entirely in your browser with crypto.getRandomValues() — nothing is sent to any server. It guarantees at least one character from each set you enable and shows an entropy estimate. Use “exclude look-alikes” when you need to type a password by hand.
Store them, don’t memorise them
Use a reputable password manager, enable two-factor authentication on important accounts, and never reuse a password across sites.
Pro tips
- Aim for “Very strong” (100+ bits) on critical accounts.
- Turn on 2FA wherever it’s offered.
- Rotate any password that appeared in a data breach.