Reusing weak passwords is one of the biggest security risks. Learn why generated passwords help and how to use free generators and strength checkers.

Most password advice is a decade out of date, and some of it actively makes things worse. The rules many organisations still enforce — a symbol, a number, a capital, changed every ninety days — were formalised in guidance that the body responsible has since publicly retracted. Understanding what replaced it changes how you should think about your own accounts.

Length beats complexity, by a very large margin

The strength of a password against brute force depends on how many possibilities an attacker has to work through. Every additional character multiplies that number by the size of the character set, which means length compounds while complexity merely adds.

Work it through and the result is counterintuitive. An eight-character password using every character type sits in a search space smaller than a sixteen-character password made only of lowercase letters. Complexity requirements buy a little; length buys enormously more.

This is why a passphrase of several unrelated words beats a short scrambled string on both counts — it is harder to crack and easier to remember. Four or five random words produce something genuinely difficult to brute force that you can actually type. The words do need to be genuinely random, though. A memorable phrase from a song or a book is not random; attackers have wordlists built from exactly that material.

What complexity rules did to human behaviour

The deeper problem with complexity requirements is that they were designed around how machines crack passwords and not around how people respond to rules.

Told to include a capital, a number and a symbol, people overwhelmingly produce the same shapes: a capital at the start, a number at the end, and an exclamation mark after it. Password becomes Password1!. Told to substitute characters cleverly, they produce P@ssw0rd — and every cracking tool has tried those substitutions since the 1990s, because they are the first thing anyone thinks of.

The result was passwords that satisfied a policy, felt secure, were painful to remember, and were not meaningfully harder to crack. Meanwhile the rules pushed people toward shorter passwords, because long ones with mandatory symbols are miserable to type.

Forced rotation makes things worse

Ninety-day expiry had the same problem. Faced with changing a password four times a year, people do not generate a new strong password each time — they iterate. Summer2026 becomes Autumn2026. The pattern is obvious, and an attacker who obtained one password can usually guess the next.

Current NIST guidance in SP 800-63B says explicitly that passwords should not be subject to arbitrary periodic expiry. They should be changed when there is evidence of compromise. The same document recommends dropping composition rules and instead checking new passwords against lists of known-breached values — because that is the threat that actually matters.

Reuse is the real risk

Here is the uncomfortable part: for most people, password strength is not the thing that will cause a breach. Reuse is.

The dominant attack is credential stuffing. A site with weak security is breached and its credentials are dumped. Attackers take those email and password pairs and try them, automatically, against banks, email providers, retailers and everything else. The attack does not crack anything — it does not need to, because the password is already known. It simply relies on the same combination working elsewhere.

Against this, password strength is irrelevant. A thirty-character random password reused on two sites is fully compromised the moment either one leaks. Uniqueness matters more than strength, and the two are often confused because strength is the thing meters measure.

This is also why breach-checking services are worth using. If a password appears in a known corpus, it is compromised regardless of how strong it looks, and no strength meter can tell you that — meters analyse structure, not history.

Generators and what they should be doing

A password generator's job is to produce values with genuine unpredictability, which requires a cryptographically secure random source rather than an ordinary pseudorandom one. In a browser that means the Web Crypto API. The distinction is not academic: ordinary random number generators are deterministic given their internal state, and that is fine for shuffling a playlist and not fine for something an adversary has a reason to predict.

Two practical points. First, prefer a generator that runs entirely in your browser, so the generated value is never transmitted anywhere — a password that travelled over the network before you used it has already had more exposure than it should. Second, do not test a real password in a strength checker on a site you do not control. Test a structurally similar variation instead. Good checkers analyse locally and send nothing, but the habit is the right one regardless.

Where passwords should live

If every account needs a long unique password, you cannot remember them, and that is the point — you are not supposed to. A password manager generates and stores them, leaving you one strong passphrase to remember for the vault itself.

The common objection is that this puts everything in one place. It does, and that is still a substantially better position than reuse across dozens of sites, because the alternative is not perfect recall — the alternative is the same password everywhere. Reputable managers encrypt the vault locally, so the provider cannot read the contents even if their own systems are breached.

Two-factor is what actually stops the attack

Everything above reduces the chance of a password being guessed or reused successfully. Two-factor authentication changes what happens when one is compromised anyway, which is why it is the single highest-value thing on this page.

The methods are not equivalent. SMS codes are the weakest, because SIM-swap attacks — where someone persuades a mobile operator to move your number — are a real and routine technique. An authenticator app generating time-based codes is substantially better, since the secret lives on your device. Hardware security keys are the strongest option available, and are the only widely deployed method that resists phishing outright, because the key checks the site's domain before responding and simply will not authenticate to a convincing fake.

If you do one thing after reading this, enable app-based or hardware two-factor on your email account. Email is the recovery channel for nearly everything else, which makes it the account whose compromise cascades furthest.