How to Create a Secure Password
A concrete process, not just principles. Five steps from "I need a password" to "it's safely stored," for new accounts, existing accounts, and memorised master passwords.
The Five-Step Process
Decide Where It Will Live
If it's going into a password manager (recommended for almost every account), you can use a fully random character string. If you need to memorise it (for your password manager's own master password, a device PIN, or a shared credential), use a random passphrase instead. See Password vs Passphrase for the full comparison.
Use the Longest Length the Account Allows
Aim for 16+ characters for stored passwords, or 5-6 words for a memorised passphrase. Length contributes more to real-world security than any other single factor. See How Long Should a Password Be? for length recommendations by account type.
Generate It, Don't Compose It
Use a cryptographically secure generator rather than typing something yourself. Human-created "random" passwords consistently contain patterns that cracking tools specifically model for. Our Password Generator uses crypto.getRandomValues() for every password.
Confirm It's Unique
Every account should have its own password, generated fresh. Never a variation of one you use elsewhere. If you're replacing a reused password, see Why You Need Unique Passwords.
Store It Properly
Save it in a reputable password manager immediately. Don't leave it in a plain text file, an unencrypted note, or a messaging app conversation "just until you memorise it". That window is exactly when it's most exposed.
For an Account You Already Have
The process is nearly identical, with two extra steps at the end:
- Generate a new password following steps 1-4 above.
- Update the password in the account's security settings.
- Update the saved entry in your password manager.
- Make sure the old password isn't still saved anywhere else (an old note, a browser's saved-password list on another device, a spreadsheet). Remove it once the change is confirmed.
For a Password You Must Memorise
A small number of credentials genuinely can't live in a password manager, most obviously the master password for the manager itself, and your device's login password. For these:
- Use a random passphrase of 5-6 words (try our Passphrase Generator) rather than a character string.
- Practice typing it a handful of times immediately after creating it. Muscle memory forms faster than you'd expect.
- Consider a physically secured written backup (a sealed envelope in a safe, not a sticky note on your monitor) in case you forget it.
Frequently Asked Questions
Use a cryptographically secure generator set to 16+ characters with all character types enabled, then save it immediately in a password manager. Faster and stronger than composing one yourself.
Yes, a master password needs to be memorised, so a 5-6 word random passphrase is more practical than an equivalent-strength random character string.
Generate a new one exactly as you would for a new account, update it in the account's settings and your password manager, then make sure the old password isn't left saved anywhere else.
Ready to generate one?
Follow step 3 right now.
Generate a strong password → Check an existing password →