How to Create Strong Passwords and Stay Secure Online

Almost every account breach that makes the news follows the same pattern: credentials stolen from one service are replayed against dozens of others. Attackers are not guessing passwords one at a time. They are running lists of billions of previously leaked pairs through automated login attempts. The practical defence is not complexity, it is uniqueness.

Length beats cleverness

A fifteen-character password of ordinary words is stronger than an eight-character password of random symbols, because the number of attempts needed grows with every added character. Attack tools are built around the shortcuts people take: capitalising the first letter, appending a digit, replacing the letter o with a zero, adding an exclamation mark at the end. All of those patterns are in the dictionaries. Randomness matters more than memorability tricks.

What a password generator should actually do

1. Generate randomness in the browser using a cryptographically secure source, not Math.random.
2. Never transmit the result. The password should exist only in the tab it was generated in.
3. Let you choose a length of at least 16 characters, and offer both a symbol-heavy mode and a longer passphrase mode.
4. Avoid characters that get mangled by systems, such as spaces in some forms, or make them optional.
5. Show an honest strength estimate rather than a coloured bar that always says strong.

Where your passwords should actually live

• A password manager is the correct answer for almost everyone. It solves uniqueness because you never need to remember the values.
• Turn on two-factor authentication everywhere it is offered, and prefer an app or hardware key over SMS where you can.
• Check whether your email address appears in known breaches, then change the passwords for any service listed, starting with email and banking.
• Write recovery codes down on paper and store them somewhere you would store a passport, rather than in the same password manager.
• Use a separate, long passphrase for your password manager itself, and never as a second copy anywhere else.

A realistic routine for the next hour

Do not attempt to change every password at once; you will abandon the project halfway. Start with the four accounts that can be used to reset everything else: your email, your password manager, your primary bank and your domain or hosting account. Generate long random values, store them in the manager, and enable two-factor authentication on each. That single hour eliminates the highest-value attack path against you. The remaining accounts can be migrated gradually as you log in to them over the next few weeks.