How to create a strong password

Most accounts are taken over because of weak or reused passwords. Creating a strong one is not hard; a few rules are enough.

Length matters more than complexity

A password's strength is the number of possibilities an attacker must try, and every extra character multiplies it. An 8-character complex password is weak next to a 16-character random one. Aim for at least 16 characters on important accounts.

The human brain is a poor random number generator

Passwords like “London2026!” look complex but match the first patterns attackers try: a capitalised word, a year and a symbol. Team, city and pet names and birthdays are all in attack dictionaries. For real randomness, let a tool generate the password.

One password per account

A password leaked from one site is tried automatically on thousands of others. Always use unique passwords for critical accounts such as email, your hosting panel and your domain registrar. A password manager is the practical way to keep track of them.

For passwords you must remember

For the few you have to memorise, such as your password manager's master password, choose a passphrase of 4–5 unrelated words. Picking the words at random from a word list is far safer than choosing them yourself.

Add two-factor authentication

Even the strongest password is useless once typed into a phishing page. Turning on two-factor authentication for cPanel, the client area and email keeps the account safe even if the password is stolen.

Our password generator creates passwords in your browser with cryptographic randomness and shows their estimated strength. To see how robust an existing password is, use the password strength test.