How to Create a Strong Password

A strong password is a long random string you have never used anywhere else, stored in a password manager rather than in your head or in a note. Sixteen or more characters from a mix of letters and digits is a practical floor in 2026. Adding a symbol helps when a site requires one. Replacing a letter in a dictionary word with @ or 0 does not.

What actually makes it hard to guess

• Length. Each extra random character multiplies the number of guesses. A short word with a symbol is still a short pattern.
• Randomness. The characters must not spell a name, a season, a year, or a keyboard walk such as qwerty.
• Uniqueness. One password per site. Reuse means one leaked database opens the rest of your accounts.
• Storage. If you can remember it easily, it is probably guessable. A manager remembers it so you do not have to.

NIST Special Publication 800-63B (published with the 800-63-4 set) requires passwords to be at least 8 characters and says verifiers should allow at least 64. It tells them not to add composition rules such as “must contain a symbol,” to reject passwords that are already common or known from breaches, and to allow password managers. Paste is recommended so a manager can fill the field. A generator on a web page cannot check a breach list for you. You still need a unique value and a manager.

The primary source is NIST SP 800-63B. Read the current revision if you are setting a password policy for a product. This article is practical advice for choosing a password, not a compliance checklist.

Random strings and passphrases

Two honest options work. A random string (for example 16 or more characters from a large alphabet) is what a generator produces, and it is the right choice when a site allows symbols and a long maximum. A passphrase of several random words can also be strong if it is long and the words were chosen at random, not because they form a sentence you like. CaseSwitch’s generator builds random characters. It does not build diceware passphrases. Do not shorten a random password into something “more memorable.”

What the CaseSwitch generator does

The Strong Password Generator picks each character in your browser with crypto.getRandomValues(), the Web Crypto random source, and it discards biased leftovers instead of using a naive modulo. Defaults are length 16, five passwords at a time, and uppercase, lowercase, digits, and symbols turned on. You can raise length up to 128, turn a class off when a site rejects it, and exclude ambiguous characters (O, 0, I, l, and 1) if you must type the password by hand.

Each line is labeled from a six-point score, not from a breach check. One point if the length is at least 12, and another if it is at least 16. Then one point each for a lowercase letter, an uppercase letter, a digit, and any character that is not a letter or digit. Score 5 or more is Strong, 3 or 4 is Medium, 2 or less is Weak. These strings are illustrations of that arithmetic. Do not use them as passwords.

abcdefgh                 8   lower only              1  Weak
abcdefghijkl            12   lower only              2  Weak
R7#kPx2$                 8   all four classes        4  Medium
Abcdefghijkl1           13   no symbol               4  Medium
onlylowercase!!         15   lower + symbols         3  Medium
Abcdefghijklmn1!        16   all four classes        6  Strong

Twelve lowercase letters are still Weak. Eight characters with a symbol are only Medium. Sixteen characters that include all four classes are Strong — and that label still does not know if you reused the password or if it is already in a breach dump. A 15-character lowercase string with two exclamation marks scores 3 (Medium) because it misses the 16-character point and misses uppercase and digits.

Generate one on the Strong Password Generator, copy a single line into your manager, and refresh the tab when you are done. The page does not keep the value.

After you generate it

• Save it in a password manager (Bitwarden, 1Password, Apple Passwords, or the manager built into your browser). The manager’s own generator is equally fine.
• Do not send it by email, chat, or SMS. Do not put it in a spreadsheet, a screenshot, or a sticky note on the monitor.
• Turn on multi-factor authentication for email, banking, and anything that can reset other accounts. A password is one factor.
• If a site caps you at 8 characters or bans symbols, use the longest length it accepts and store that. The site’s rule is the weak part, not a reason to invent Summer2026!.
• Change a password when you learn it was exposed. You do not need to rotate a long random password on a calendar.

What this will not protect you from

A strong password does not stop a phishing page that you type it into, a malware stealer on the computer, or a site that stores passwords badly. It also does not replace a hardware key or an authenticator app. MD5 or Base64 of a word is not a password scheme. UUID values are identifiers, not login secrets.

How local generation differs from pasting a secret into a server-side tool is explained in local browser processing and privacy.

Questions people ask

How long should a password be?

Use at least 16 random characters when the site allows it, and longer for anything you cannot afford to lose. NIST SP 800-63B requires sites to accept passwords of at least 8 characters and says they should allow at least 64. It also says not to add composition rules, such as a required symbol, and to allow password managers. A long random string beats a short word with a clever substitution.

Does the CaseSwitch password generator store the password?

No. Each character is chosen in your browser with crypto.getRandomValues(). CaseSwitch does not upload or save the result. Copy it into a password manager. Refreshing the page discards anything you did not copy.

Are symbols required for a strong password?

No. Length and randomness matter more than a required symbol. Symbols help when a site demands them, and the generator can include them. A password like P@ssw0rd is still weak because it is a common pattern. Turn symbols off only when the site rejects them, then use the longest length that site allows.