My old “system” was one base word plus site-specific suffixes — until a forum breach handed attackers the pattern and two of my accounts fell in a week. Rebuilding with real randomness took an afternoon and has held for years. This is how to create a strong password in 5 steps: the 16-character rule, settings, uniqueness, storage and 2FA — each step tested in September 2026 with our local tools.
Part of the password generator guide — the pillar covers the system, this is the hands-on walkthrough. Open the free password generator in the next tab. No signup, offline after load.
Create one in 5 steps (~3 minutes)
Step 1 — Set length 16+ (20 for important accounts)
Open the generator, drag length to 16 minimum — 20 for email, bank and manager master adjacent. Length is the dominant variable: 16 full-pool characters carry ~104.9 bits. Everything below is tuning.
Step 2 — Enable all four pools
Upper, lower, digits, symbols ON (94 printable characters, ~6.55 bits each). If a site forbids symbols, add 2 characters of length to compensate rather than accepting weakness.
Step 3 — Generate 3, pick 1, never hand-edit
Generate three candidates and take one verbatim. Hand-“improving” randomness (swapping a character you distrust) only shrinks unpredictability — trust the uniform draw from crypto.getRandomValues.
Step 4 — Store immediately in a manager
Copy straight into a password manager — any reputable one; we take no affiliates and rank none. Never into notes apps, chats or screenshots. The manager holds 200 unique secrets; your brain holds two passphrases per remembering guide.
Step 5 — Enable 2FA on email and bank today
Authenticator app over SMS (SIM-swappable). Email first — resets flow through it. Passkeys where offered. Order and setup in 2FA vs passkeys.
Uniqueness: one site, one password, no exceptions
Credential stuffing replays leaked pairs across hundreds of sites automatically — reused passwords fall in bulk, unique ones fall alone. After generating, search your memory honestly: if any live account shares substantial structure with the new secret, rotate that account too, starting with email and bank. Breach already happened? Priority order (breached + reused first, MFA second, monitor third) in breach checklist. Theory behind the bits in what makes passwords strong.
When generated passwords will not work (site limits)
- Max-length caps (looking at you, banks): some legacy sites cap at 12–16. Max the length, enable all allowed pools, and note the site as weak — enable every alert and MFA option it offers.
- No-symbol rules: compensate with length (+4 characters beats a symbol set mathematically at these sizes).
- Forced rotation policies: employer-mandated 90-day changes contradict NIST — comply for work accounts (their rules), keep personal vault on breach-only rotation.
- Shared accounts: family streaming logins cannot be unique-per-human — use a long passphrase everyone memorizes, and never reuse its pattern for personal accounts.
Your personal rotation policy (write it once)
Decide in advance when passwords change, or every breach becomes a debate. The policy: rotate on compromise evidence, service breach notices, team/device changes, and suspected phishing — never on calendars. Write the trigger list on paper with your recovery codes: “change when: breach notice naming the service, unknown login alert confirmed, device lost unencrypted, ex-partner/roommate access ends, employer exit.” Review annually in 10 minutes; the list rarely changes, but having it ends the “should I change everything?” panic that produces weaker replacements. Pair with the breach order so triggers map to actions, not anxiety.
General information only, not security advice. Generate offline, store in a manager, enable MFA on email/bank. If you lose your master password it cannot be recovered by us.