How to Create a Strong Password: Length, Randomness, and Common Mistakes

A strong password is not created by adding one capital letter and one exclamation mark to a predictable word.

The qualities that matter most are length, unpredictability, uniqueness, and safe storage.

Prefer long and unpredictable passwords

Attackers do not have to guess passwords manually. Automated guessing can test large numbers of candidates, especially when a service stores passwords incorrectly or a password database is stolen.

Long, randomly generated passwords are much harder to guess than short human-made patterns.

Use Duck Cloud's Password Generator to create passwords with cryptographically secure browser randomness.

Do not reuse passwords

Password reuse turns one breach into many account compromises.

If the same password is used for email, cloud hosting, social media, and developer services, exposure at one service gives an attacker a credential to try everywhere else.

Use a unique password for every important account.

Use a password manager

Humans are bad at memorizing dozens of long random passwords. A password manager solves that by storing unique credentials and helping generate new ones.

That allows the user to remember one strong master password rather than weakening every account password.

Protect the password manager itself with a strong master password and multifactor authentication when supported.

What about passphrases?

A sufficiently long passphrase can be easier to remember than a random character string.

The key is avoiding familiar quotations, song lyrics, keyboard patterns, personal facts, or common phrases.

Randomly selected unrelated words can be useful when memorization is necessary, especially if the phrase is long and not reused.

Common weak patterns

Avoid patterns such as:

• Password123!;
• company name plus year;
• birthday plus initials;
• keyboard sequences such as qwerty;
• replacing a with @ in a common word;
• repeating the same base password with a different site name.

Attackers know these transformations too.

Password strength meters are estimates

A strength checker can help identify obvious weaknesses, but it cannot prove that a password is safe.

Use the Password Strength Checker to inspect a candidate locally. Treat the result as feedback, not a guarantee.

A password may score well but still be unsafe if:

• it was reused;
• it appeared in a breach;
• it is based on personal information;
• it is stored in an insecure location;
• malware captures it;
• the account has no protection against phishing.

Enable MFA

Multifactor authentication adds another barrier when a password is stolen.

Where available, prefer strong phishing-resistant methods such as security keys or passkeys. Authenticator applications are generally preferable to relying only on SMS when stronger options exist.

MFA does not make password quality irrelevant, but it reduces dependence on a single credential.

Developers: never log passwords

Applications should not log plaintext passwords, password-reset tokens, or authentication secrets.

Be careful with:

• request logging;
• analytics;
• error traces;
• support screenshots;
• browser console output;
• test fixtures;
• CI logs.

Secrets frequently leak through debugging tools rather than through the authentication algorithm itself.

Developers: store passwords correctly

Server-side password storage requires dedicated password hashing algorithms such as Argon2 or scrypt with unique salts and appropriate cost settings.

Do not store plaintext passwords.

Do not store passwords using reversible Base64 encoding.

Do not hash passwords directly with a fast general-purpose hash such as SHA-256.

Password checklist

1. Use a unique password for every account.
2. Prefer long, randomly generated passwords.
3. Store them in a reputable password manager.
4. Protect the manager with a strong master password.
5. Enable MFA or passkeys where available.
6. Do not send passwords through chat or screenshots.
7. Rotate credentials immediately after confirmed exposure.
8. For applications, use dedicated password hashing rather than fast general hashes.

A password does not need to be clever. It needs to be difficult to predict, unique to the account, and handled safely throughout its lifetime.