How to create strong passwords nobody can crack

116 billion credentials leaked in 2025. If your password was in any of those dumps (and it probably was), it's worthless now. It doesn't matter that you "made a strong password" — what matters is whether it shows up in a wordlist hackers use to test logins at scale. And it does.

Good news: making a password that survives both brute-force AND dictionary attacks is simple if you follow 4 rules.

The problem isn't the content — it's the pattern. "Password@123" has uppercase, lowercase, number and symbol. Passes any form's requirements. But it's in the top-50 most-used English passwords. Hackers test it BEFORE any brute-force. Your account falls in 0.2 seconds.

Strong password = NOT in any known wordlist + long enough that brute-force is infeasible. Visual complexity has nothing to do with it.

• —Length ≥ 12 characters. Each extra character doubles crack time. 12 chars = years. 16 chars = centuries. 8 chars = hours.
• —Random. Human-generated passwords follow predictable patterns (word + number + symbol at end). Use a generator.
• —Unique per service. Leaked on LinkedIn? Hackers try the same on your bank. If different, they stop there.
• —Stored in a manager. You don't need to memorize — you need 1Password, Bitwarden or KeePass to remember for you.

• —8 characters (letters only): instant
• —8 characters (mixed): 1 hour
• —12 characters (mixed): 200 years
• —16 characters (mixed): 1 trillion years
• —20+ characters (mixed): essentially impossible with current hardware

These assume offline brute-force (RTX 4090 cards testing 100 billion hashes/sec). Real attackers take longer thanks to rate limiting, but the margin is clear: 12+ chars is the floor, 16 is the sweet spot.

Swapping letters for numbers (leet speak)

"P@ssw0rd" isn't safer than "Password" — all modern wordlists test leet variants automatically. You just made it harder for yourself, easier for nobody else.

Passphrases without randomness

"I love coffee in the morning" is 28 characters but it's a common English phrase. 4-5 word phrase wordlists crack it. Passphrases work only if words are RANDOM (correct-horse-battery-staple, the XKCD classic).

Using your email password "for important stuff"

Email is the root. Whoever takes your email resets ALL other accounts (bank, social, AWS) via "forgot password". Your email password has to be the most unique and longest of all. And 2FA via authenticator app, not SMS.

• —Use the generator below to create a 16+ char password with everything enabled.
• —Save it in your manager (1Password, Bitwarden, or your browser's).
• —Enable 2FA on every account that supports it — prefer authenticator app (Authy, Aegis) over SMS.
• —Check if your email leaked at haveibeenpwned.com. If yes, change that password EVERYWHERE you used it.