Websites get breached, and stolen passwords get tried on other websites. A short password, or one you use in many places, is the easy way in for an attacker. A long, random password that you use for only one account is much harder to guess.
This guide explains what makes a password strong, how to make one with our free Password Generator, and the habits that matter as much as the password itself.
What Makes a Strong Password?
- Length: each extra character multiplies the number of possible passwords. With the 88 characters our generator uses, a 12-character password has about 60 million times more possibilities than an 8-character one (88 × 88 × 88 × 88). Use 16 characters or more for important accounts.
- Randomness: the password must be picked at random, not by you. People choose patterns that attackers try first, such as a word plus a year.
- A mix of character types: upper case, lower case, numbers and symbols make each character harder to guess. But length helps more. 20 random lower-case letters are stronger than 12 random characters of all four types.
- One password per account: if one site leaks its passwords, attackers try the same email and password on other sites. This is called credential stuffing. A unique password stops it.
Nobody can remember dozens of random 16-character passwords. That is why people use a password generator to make them and a password manager to store them.
How to Generate a Strong Password for Free
- Open the tool. Go to the FreeToolPoint Password Generator. A 16-character password with all four character types is already made when the page opens.
- Set the length. Move the slider to any length from 4 to 128 characters. Use at least 16 for email, banking and cloud storage. If a site has a maximum length, use the longest it allows.
- Choose the character types. Tick or untick Uppercase, Lowercase, Numbers and Symbols. If a site does not allow symbols, untick Symbols and add two characters to the length instead.
- Click Generate for a new password with the same settings. The tool shows one password at a time and does not keep old ones.
- Copy and save it. Click Copy and paste the password into your password manager or the sign-up form.
Each character is picked with your browser's crypto.getRandomValues(), which is built for security use. The password is made in the page and is not sent to our server.
One thing to know: every password has at least one character from each ticked type. So if Numbers is ticked, there is always a number, and sites that say a password must contain a number accept it.
Password Habits That Matter
A strong password is only part of the job. These habits matter just as much:
- Use a password manager. Bitwarden, 1Password and KeePass are well-known examples. A manager stores your passwords in an encrypted vault and fills them in for you. You only need to remember one master password.
- Turn on two-factor authentication (2FA). Then a stolen password alone is not enough to log in. An authenticator app is safer than SMS codes, because a phone number can be moved to another SIM card by a scammer.
- Never reuse passwords. A password manager makes a unique password for every site easy.
- Leave out personal details. Birthdays, pet names and street names are often easy to find on social media.
Common Password Mistakes
- Dates and names: birthdays, anniversaries, children's and pets' names are among the first things attackers try.
- Common passwords and patterns: “password123”, “qwerty” and “letmein” appear on every list of leaked passwords. Attackers try these lists first.
- Swapping letters for symbols: changing “a” to “@” or “o” to “0” adds very little. Cracking tools try these swaps automatically, so “P@ssw0rd” is barely stronger than “Password”.
- Small changes to an old password: changing Summer2024! to Summer2025! is easy to guess for anyone who saw the old one.
- Using the same password everywhere: one leak from a small website can open your email and other accounts.
- Keeping passwords in a plain note or chat: anyone with access to your phone or messages can read them. Use a password manager instead.
How Often Should You Change Passwords?
Many workplaces used to force a password change every 30, 60 or 90 days. When people are forced to change often, they tend to make small, easy-to-guess changes, such as Password1 becoming Password2.
The U.S. National Institute of Standards and Technology (NIST) covers this in its digital identity guidelines, NIST SP 800-63B. In general, the guidance favors longer passwords. It tells services not to force password changes on a schedule and not to demand a mix of character types. It says a password should be changed when there is evidence it has been compromised.
So change a password when there is a reason:
- After a data breach: if a service you use reports a breach, change that password. Also change it anywhere you used the same one.
- If you see signs of misuse: login alerts you do not recognise, strange account activity, or reset emails you did not ask for.
- When you find reused passwords: give each of those accounts its own new password.
- After sharing access: if you gave a password to someone for a while, change it when they no longer need it.
Summary
Use a long, random, unique password for every account. Store them in a password manager, and turn on two-factor authentication for important accounts. Change a password when there is a reason, not on a timer. These steps protect you against the most common ways accounts are taken over, such as reused and easy-to-guess passwords.