Most account breaches don't come from someone guessing a password character by character — they come from reused passwords. One site gets breached, the leaked email-and-password list circulates, and every other account using that same password becomes vulnerable too. Understanding this changes what's actually worth doing.
The two things that matter most
- Use a different password for every account. This one habit limits the damage from any single breach to just that one account.
- Make each password long and random. Length matters more than clever substitutions — "correct horse battery staple"-style length beats "P@ssw0rd!"-style complexity, because random length is what actually resists automated guessing.
Why "random" is doing a lot of work
A password you can consciously think up — even one that feels random to you — tends to follow patterns common to human-generated passwords, which password-cracking tools are specifically tuned to try first. A password generated by a proper random process doesn't have that weakness, because there's no human pattern to exploit in the first place.
A practical system
- Use a password manager to generate and store a long, random, unique password for every account — this is the single highest-leverage habit, since it makes point 1 and point 2 above effortless instead of a constant mental burden.
- Turn on two-factor authentication anywhere it's offered, especially for email (since email access often allows resetting everything else).
- For the few passwords you truly must memorize (your password manager's own master password, your device login), length is your friend — a long passphrase of unrelated words is both memorable and strong.
The Password Generator creates random passwords using your browser's cryptographically secure random number generator, with control over length and which character types to include — useful for quickly generating a strong, unique password for a new account.