How to Create a Strong Password and Check If It Was Leaked
Most password advice is outdated. Forced symbols and monthly changes made passwords harder to remember without making them much safer. Modern guidance focuses on three things: length, uniqueness, and checking against leaked passwords. Here is how to apply it.
What makes a password strong
Attackers don’t guess passwords one by one by hand. They run software that tries billions of combinations, starting with leaked passwords, dictionary words and common patterns like Summer2026!. A strong password is one that software can’t predict: long and random.
Length matters more than complexity. Each extra random character multiplies the number of possibilities, while swapping a for @ is one of the first tricks cracking tools try.
Generate, don’t invent
People are bad at randomness: we pick names, dates and keyboard patterns. Use the Password Generator instead. Sensible settings:
- 16+ random characters for anything stored in a password manager.
- A passphrase of 4–6 random words (for example
staple-orbit-canyon-velvet-mint) for the few passwords you must type or remember, like your computer login or the manager’s master password.
The words must be chosen randomly by the tool. A phrase you made up yourself, such as a song lyric or quote, is far easier to guess.
Never reuse a password
Reuse is the biggest real-world risk. When any site is breached, attackers try the leaked email-and-password pairs on email, banking and shopping sites — a technique called credential stuffing. A unique password for every account means one breach stays one breach.
Nobody can remember 100 unique passwords, which is what password managers are for. Your browser’s built-in manager or a dedicated one both work; what matters is that you use one.
Check whether a password has leaked
The Password Breach Checker tells you if a password appears in known breach collections, without sending the password anywhere. It hashes the password in your browser with SHA-1 and sends only the first five characters of the hash to the Have I Been Pwned service, which returns every leaked hash starting with those characters. The match is checked on your device. (You can see what a hash looks like with the Hash Generator.)
If a password shows up, change it everywhere you used it — even if it looks strong, it is now on the lists attackers try first.
What current guidance says
The US National Institute of Standards and Technology’s digital identity guidelines (NIST SP 800-63B) recommend that services:
- Allow long passwords (at least 64 characters) and all printable characters, including spaces.
- Check new passwords against lists of breached and common passwords.
- Not force arbitrary composition rules or periodic changes — change a password when there is evidence it was compromised.
Add a second factor
Even a perfect password can be phished. Turn on two-factor authentication for email, banking and anything that can reset other accounts. An authenticator app or a passkey is stronger than SMS codes, but any second factor is much better than none.
Use the Password Strength Checker to see how long a password would resist guessing, and why — it flags dictionary words, dates and patterns.
