Pick Strong Passwords Without Hating Your Life
Length beats complexity. Here is a practical playbook for creating, storing and rotating passwords in 2026.
Everyone knows they should use strong passwords. Almost nobody does. The gap is not laziness — it's that most advice is written for security engineers, not humans.
Length beats complexity
A 16-character password of random lowercase letters is stronger than an 8-character password with symbols. Aim for 16 or more characters. Use our Password Generator to spit them out.
Do not memorise them
Memorising unique 16-char strings is impossible. Do not try. Instead:
- Use a password manager (Bitwarden, 1Password, iCloud Keychain).
- Set one very strong master password you can actually remember (a random 6-word phrase works).
- Let the manager fill everything else.
What to rotate, when
Blanket rotation every 90 days is bad advice — it pushes people to weaker patterns. Rotate when:
- A service is breached (check haveibeenpwned.com).
- You suspect a device is compromised.
- You leave a job or a shared account.
Otherwise, leave them alone.
Turn on 2FA everywhere it matters
Email, banking, cloud drives, code hosting. A stolen password is not enough if the attacker also needs a code from your phone.
API tokens and secrets
For code, generate stable identifiers with the UUID Generator and hash sensitive tokens with the Hash Generator. Never commit either to a repo.