How to Generate Secure Passwords (and Stop Reusing Old Ones)

The single biggest threat to your accounts

It isn’t hackers in hoodies. It’s password reuse. When one site is breached, attackers take the leaked email/password pairs and try them on every other major service. If you used the same password on Spotify and your bank, your bank account is now in the same breach.

The fix is simple to describe and a little harder to live: every account gets a unique, strong, random password.

What "strong" actually means

A strong password is one that can’t be guessed by:

1. Personal-info attacks — your dog’s name, birthday, partner’s name, favorite team.
2. Dictionary attacks — common words and phrases, with letter substitutions.
3. Brute force — every combination of characters up to a certain length.

The defense against (1) and (2) is randomness. The defense against (3) is length.

Length beats complexity

A 16-character password using only lowercase letters has more entropy than an 8-character password with mixed case, numbers and symbols. The math is unforgiving: every additional character multiplies the search space.

Modern recommendation: - 16 characters for everyday accounts - 20+ characters for email and financial accounts - 24+ characters for password manager master passwords

Use a generator, not your imagination

Humans are terrible at random. We pick patterns we recognize. Use a tool like the FastDailyTools Password Generator which uses your browser’s cryptographically secure random source.

Then use a password manager

Memorizing one secure password is fine. Memorizing a hundred is impossible. Use a password manager — 1Password, Bitwarden, KeePass, or your browser’s built-in one. Generate, store, autofill. Done.

Two-factor authentication is non-negotiable

Even the best password can be phished. Add 2FA — preferably with an authenticator app (Aegis, Raivo, Authy) or a hardware key (YubiKey). SMS 2FA is better than nothing, but vulnerable to SIM-swap attacks.

A 30-minute setup that protects you for years

1. Install a password manager
2. Generate a strong master password
3. Turn on 2FA for your password manager
4. Rotate the passwords on your top 10 accounts (email first)
5. Over the next month, rotate the rest as you log in

Set the foundation once, and the protection compounds.