How to Create a Strong Password

A strong password isn't one with a capital letter, a number, and an exclamation mark stapled on the end. That advice is twenty years old, and it's exactly the pattern attackers' software guesses first. Password1! ticks every "complexity" box your bank's signup form asks for — and it would survive a real cracking attempt for about a second.

What actually makes a password hard to crack is simpler than the rules suggest: length, and randomness. A long string of genuinely random characters has no pattern to exploit, so the only way to break it is to try every possibility — and that quickly becomes a problem that takes longer than a human lifetime.

This guide explains what makes a password strong (with the math, briefly), the myths worth dropping, and how to generate one that's secure in a single click using FileNaut's free Password Generator — which runs entirely in your browser, so the password it creates is never sent anywhere.

Two things, in order of importance:

1. Length. Every character you add multiplies the number of possible passwords. This is the single biggest lever you have, and it's why a long password made of simple characters can beat a short one stuffed with symbols. An 8-character password drawn from all character types has roughly 6 quadrillion combinations — sounds like a lot, but modern hardware chews through that. Push to 16 characters and the number of combinations is so large that brute-forcing it is effectively off the table with today's technology.

2. Randomness. "Random" means no pattern a human or a program can predict. Tr0ub4dor&3 looks random to a person but follows a guessable recipe (word + predictable substitutions + number + symbol). True randomness comes from a source that isn't a human brain — which is exactly what a generator gives you.

A quick comparison of why length wins:

The most reliable way to get a genuinely random password is to let a tool generate it. Here's how with FileNaut's Password Generator:

1. Open the Password Generator. A strong password is generated the moment the page loads — you don't have to do anything to get a working result.
2. Set the length. Drag the slider to your target length. It runs from 8 to 128 characters; the default is 16, which is a solid floor for most accounts. Bump it to 20+ for anything important.
3. Choose the character types. Four toggles — uppercase, lowercase, numbers, and symbols — are all on by default. Leave them all on unless a specific site refuses certain symbols (more on that below).
4. Read the strength meter. The badge in the corner shows Weak, Good, or Strong based on your length and selected character types. Aim for Strong.
5. Click "Copy Password." One click copies it to your clipboard. Hit the refresh icon any time to roll a completely new one.

That's it. The password is built in your browser using your device's cryptographically secure random number generator — the same class of randomness used for encryption keys, not the predictable Math.random() that many web tools rely on. Nothing is transmitted, logged, or stored. When you close the tab, it's gone.

There's no single answer — match the length to what the account protects:

A 20-character random password is unbreakable and unmemorable — that's the trade-off, and pretending otherwise is how people end up reusing one "strong" password everywhere (which defeats the entire point). A generated password is only practical if you have somewhere to keep it. Two realistic options:

• Use a password manager. This is the right answer for almost everyone. It stores a unique generated password for every account and fills it in for you, so you never type or remember any of them. You then only need to remember one master password.
• For that one master password, use a passphrase. Four or five random, unrelated words strung together — something like correct-anchor-velvet-mountain — is long enough to be strong and human enough to memorize. (FileNaut's generator produces random-character passwords, not word passphrases, so build your master phrase by hand: pick words that have no connection to each other or to you.)

The model that actually works: one memorized passphrase → unlocks a password manager → which holds a unique generated password for every site.

• "Change your passwords every 30/90 days." Outdated. Modern security guidance (including NIST's) says forced routine changes make security worse, because people respond by making small predictable tweaks (Spring2026! → Summer2026!). Only change a password when there's a reason to — a breach, or you suspect it's exposed.
• "Swapping letters for symbols makes it strong." a→@, e→3, s→$ are the first substitutions cracking tools try. They add almost nothing.
• "A strong password is enough." It isn't, on its own. Turn on two-factor authentication (2FA) wherever it's offered. Even a perfect password can be phished; 2FA is the backstop.
• "Reusing a strong password is fine if it's strong." This is the most dangerous myth. When one site gets breached, attackers take the leaked email/password pair and try it everywhere else — "credential stuffing." Reuse turns one breach into ten. Every account needs its own password.

Occasionally you'll paste a generated password and the site complains. Usual causes and fixes:

• "Symbols not allowed" or a length cap. Some older systems restrict which characters they accept, or cap length at 16–20. In the generator, turn off the Symbols toggle (keep length maxed) or drag the length down to the site's limit, then regenerate.
• "Must contain a number/uppercase." All four character types are on by default, so this is rare — but if you turned some off, switch them back on.
• Pasting fails. A few banking sites block paste in password fields. Make the password slightly shorter so it's typeable, or use your password manager's autofill, which bypasses the paste block.