How to Generate Strong Random Passwords

A strong password is long, unpredictable, and used for only one account. The easiest way to get all three is to generate it with a password manager or a random password generator, then let a manager store and fill it for you.

This guide covers practical password lengths, memorable passphrases, unique passwords, and multi-factor authentication (MFA). It also explains how to check a password without exposing a real secret.

Choose a practical length

For a randomly generated password, aim for at least 16 characters when the service allows it. More length can help, but only when the password is genuinely random. A long password based on a name, date, or familiar phrase may be easier to guess than a shorter, randomly generated one.

Use the largest length the service accepts if you can store the result in a password manager. Check the service’s rules first: some restrict length or reject certain characters. If a password must be typed often, a passphrase may be easier to handle.

Length matters because each added character can increase the number of possible combinations. But a person choosing characters tends to follow patterns, such as capitalizing the first letter or adding a number at the end. Random generation avoids relying on those predictable choices.

Use a random passphrase when typing matters

A passphrase is a sequence of words used as a password. It can be easier to type and remember than a string of mixed characters. For good security, the words should be selected randomly from a sufficiently large list, not assembled from a quote, song lyric, or personal detail.

A practical starting point is four or more randomly selected words; for a high-value secret such as a password manager master password, use six or more. Add words if the service allows it and the passphrase needs extra length. Separators can make the words easier to read, but symbols do not make a predictable phrase random. The important part is that the words were chosen unpredictably.

For example, a randomly selected phrase might have a structure like copper-lantern-orbit-velvet. This is only an illustration, not a password to use. Do not use examples from an article or a phrase you created yourself; generate a fresh one for each account.

Generate rather than invent

People are good at making passwords memorable, but not at making them random. Avoid names, birthdays, keyboard patterns, favorite teams, quotations, and small changes to an old password. Changing password to Password1! follows a pattern that attackers can anticipate.

Use the TIG Password Generator to create a random candidate. Choose a length and character set the account accepts, then generate a new password for that account. If a site rejects a character, generate another password with a compatible character set rather than making a predictable edit to the first one.

A password strength checker can provide general feedback on length and patterns. The TIG Password Strength Checker may help you understand why a candidate looks weak, but a score is not proof that a password is safe. Different checkers use different methods. For privacy, do not enter an existing or important password into a checker unless you understand how it handles the text; the TIG checker runs in your browser and does not send it anywhere, but a disposable example with the same structure works just as well. The checker also cannot tell you whether a password has appeared in a data breach.

Give every account a unique password

Never reuse a password across accounts. If one service is breached, attackers may try the exposed email-and-password combination on other sites. A unique password limits that reuse risk: a leaked password for one account does not unlock another account that has a different password.

This is especially important for email, banking, work, cloud storage, and social accounts. Email accounts are often used to reset passwords elsewhere, so protect them with a unique password and MFA.

If you discover that a password has been exposed, change it on the affected service and anywhere else you reused it. Choose new, distinct passwords rather than adding a character to the old one.

Store passwords in a password manager

A password manager can generate and remember long, unique passwords, so you do not have to memorize each one. Use a reputable manager that fits your devices and needs, and protect its account with a strong, unique master password or passphrase. Turn on MFA for the manager if it offers it.

Keep the master password separate from the password vault. Do not reuse it on another site or share it. Set up the manager’s recovery options and store any recovery information securely. If you lose access to the manager, recovery may depend on the service’s specific process, so understand that process before relying on it.

Autofill can also help reduce typing mistakes and make it easier to use a different password on every site. Before accepting an autofill prompt, check that the website address is the service you intended to visit.

Add MFA to important accounts

MFA asks for another proof of identity in addition to your password, such as an authenticator-app code, a security key, or a prompt on a trusted device. It can help protect an account if someone learns or steals the password. Turn it on for email, financial accounts, work accounts, and your password manager wherever available.

When offered, a passkey or a hardware security key can provide strong protection against phishing. Authenticator apps are another option. SMS codes are generally less resistant to account takeover than those methods, but can still be preferable to using no additional factor when that is the available choice.

Save recovery codes somewhere secure, such as in your password manager or another protected location. Do not keep the only copy on the device that requires the code to recover access.

A worked example

Suppose you create an account for a photo-storage service. You could follow this process:

1. Generate a fresh password of at least 16 characters, using only characters the service accepts.
2. Save it directly in your password manager under the correct website.
3. Check that the manager has not filled in a password already used for another account.
4. Turn on MFA and save the recovery codes securely.
5. If the service requires a password you can type regularly, generate a passphrase from randomly selected words instead, and store it in the manager.

The example describes a process, not a password to copy. The password for this service should be different from the one for email, shopping, or any other account.

Summary

• Use a randomly generated password of at least 16 characters where the service permits it, or a passphrase made from randomly selected words.
• Give every account its own password and store them in a password manager.
• Avoid personal details, familiar phrases, and predictable edits to old passwords.
• Enable MFA on important accounts and keep recovery codes in a secure place.