A strong password is not enough: why reuse is the real risk

There is a lot of advice about making a password strong: more characters, more symbols, a number and a capital. Most of it is right, and most of it solves the easy half of the problem. A generator can hand you a 16-character random string in a second. The half that actually gets people breached is quieter: using that password, or a close cousin of it, in more than one place. This is what makes a password strong in 2026, why reuse is the risk that matters, and what closes the gap that a generator on its own leaves open.

What actually makes a password strong

Strength is about how many guesses an attacker would need, and that is driven first by length, then by how many character types are in play. The standard way to measure it is entropy, in bits: each extra bit doubles the number of possible passwords. A 16-character password drawn from the full set of upper and lower case letters, digits and symbols carries more than 90 bits of entropy, which is enough that brute-forcing it is not a realistic attack.

This matches where official guidance has landed. Since its 2017 revision, US NIST guidance (SP 800-63B) has pushed length over forced complexity:

• Favour length. A low minimum is allowed, but long passwords are what actually move the needle, so aim for 16 characters or more.
• Drop the composition rules. Mandatory upper-plus-symbol-plus-digit recipes push people toward predictable patterns like Password1! rather than genuine randomness.
• Stop forcing periodic rotation. Changing a password on a fixed schedule mostly produces weak variations; change it on a real signal instead, such as a breach.
• Screen against known-breached passwords, because a password that is technically strong but already in a breach dump is worthless.

A good generator gives you all of this for free: it is random by construction, has no predictable pattern, and you can set the length as high as you like.

The real risk is not weakness, it is reuse

Here is the part the strength meter cannot see. The most common way ordinary accounts get taken over is not someone brute-forcing a strong password. It is credential stuffing: attackers take the email-and-password pairs leaked from one breached site and replay them, automatically, against hundreds of other sites. If you used the same password on your email, your shop, and that forum that got breached two years ago, then one leak quietly unlocks all three.

The scale of available material is the problem. Have I Been Pwned, the public breach-tracking service, holds hundreds of millions of unique passwords seen in real breaches, each tied to addresses that get tried again and again. Against that backdrop, the strength of any single password barely matters if it is shared across accounts. A unique password per site is what breaks the chain: a leak from one place unlocks exactly one place.

Why a generator alone does not close the gap

So the real instruction is not just make it strong, it is make a different strong one for every account. And that is where a generator on its own runs out of road. Nobody can memorise dozens of 16-character random strings. Faced with that, people do the human thing: they reuse one good password everywhere, or they build a pattern (the same base with the site name bolted on) that an attacker who sees two of your leaked passwords can guess. Either way the uniqueness, the part that actually protects you, quietly collapses. A generator without somewhere to keep its output just moves the problem one step down the road.

What a password manager actually does

A password manager is the piece that makes per-site uniqueness practical. It generates a fresh random password when you sign up, stores it in an encrypted vault, and fills it in for you on the right site, so you never type or even see most of your passwords. You memorise exactly one thing, the master password to the vault, and that one you make a long passphrase. Most managers also warn you when a stored password turns up in a known breach, which turns the screening NIST recommends into something automatic. The free tier of a reputable manager covers this for the vast majority of people.

So use the generator below for the strong, random part, and pair it with a manager so every account gets its own. That combination, not any single clever password, is what keeps one breach from becoming five.