Password security guide: length, randomness, and safe storage

A password does not stop credential stuffing once it has been reused, and it does not stop a phish or a keylogger on its own. Generate a unique string with a Password Generator, store it in a manager, and turn on MFA for email and banking. Length and randomness matter more than a symbol swapped in by hand.

One reused work-email password shows how small the failure is. The password was 10 characters with symbols, not something like password123. It was also used on a hobby forum. The forum leaked it. Attackers tried the same email and password on Microsoft 365 and got in because MFA was off. The forum had stored it in a form that could be cracked. Weak passwords are rarely guessed by someone typing. Breached databases get cracked, then the pairs get tried on other sites. A unique random password per account, plus MFA, still stops most of those takeovers.

Passwords are still the gate

Passkeys and SSO are spreading, unevenly. Email, banking, work apps, and a long list of other accounts still ask for a password, and they will for years.

A unique password per account is one of the highest-impact habits you can pick up. The cost is setting up a manager once.

What actually makes one strong

P@ssw0rd is predictable to cracking tools. Length and randomness are the part that changes the odds.

Useful traits:

• At least 12 to 16 characters for ordinary accounts, and longer for high-value ones
• A random mix from a generator, not one memorable phrase reused everywhere
• A different password for each site or service

A 16-character random string from a Password Generator holds up to brute force far better than an 8-character password built from a pattern.

| Approach | Example | Problem | | --- | --- | --- | | Short, with symbols | Tr0ub4dor& | In dictionaries; crackable | | Substitution | P@ssw0rd! | Pattern attacks already know this shape | | Random 16 characters | k8Jm2pL9vN4xR7qW | High entropy; unique per site | | Long passphrase | correct-horse-battery-staple | Works when it is long and not a famous phrase |

Use a manager

People cannot memorize dozens of high-entropy passwords. A manager stores them encrypted, fills logins, and syncs across devices.

A browser's built-in manager is convenient and tied to one browser profile. Sharing and recovery are weaker than in a dedicated manager. For most people, a dedicated manager with MFA on the vault is the stronger setup.

Workflow:

1. Generate a new password for each signup, in the manager or with a generator.
2. Save it in the manager immediately. A sticky note is a copy in plain text.
3. Do not reuse the work email password on a forum.

If you have to share a family Wi-Fi password, use the manager's shared vault. A text message stays in the chat history.

Generating one without leaking it

An online generator is fine when:

• It runs in the browser and does not send the password to a server
• You copy the result into a manager and do not leave it on a screen in public

The Vertex Solutions Password Generator builds random strings with a length and character set you choose. Drop ambiguous characters (0, O, l, 1) when the site rejects them.

A passphrase of random words can be long enough to make up for a smaller character set, which helps when a site blocks symbols. Skip famous lines from books or songs. Use a random word list from the generator.

MFA

A strong password plus MFA stops most credential stuffing even after a leak. Turn it on for email, banking, and any account that can reset other accounts.

Prefer an authenticator app or a hardware key over SMS where you can. SIM-swap attacks target SMS codes. Two-Factor Authentication Basics suggests an order: email first, then banking, then the rest.

Email MFA is the one to do first. Email is how other sites reset their passwords.

Habits that undo the rest

• Reusing a password. One breach exposes every account that shares it.
• Plain text in a notes app. Use a manager that encrypts the vault.
• Emailing a password. Email is not end-to-end encrypted by default.
• Rotating on a short timer with no reason. NIST favors a change after compromise, not a 90-day cycle, when the password is already long and random.
• Names, birthdays, and pet names. Those strings are already in wordlists.
• Sharing in chat with a link that does not expire. Slack and Teams keep history.

On a shared machine, clear the clipboard after you paste. See Clipboard Security for Sensitive Data.

Passwords, API keys, and tokens

API keys and JWT signing keys should not be passwords a person can remember. Generate a long random token, store it in a secret manager or an environment variable, and rotate it if it leaks.

A UUID Generator makes identifiers for local test data. Those are not authentication secrets. Avoid predictable sequential IDs on a public API when someone can enumerate them.

Base64 Encode wraps data for transport. It is not encryption. Encoding an API key does not protect it.

After a breach

If a service says it was breached, or you find your email in a breach database:

1. Change that site's password immediately. Make the new one generated and unique.
2. Change any other account that reused it.
3. Review MFA and active sessions. Revoke devices you do not recognize.
4. Watch for phishing that pretends to be the breached company.

Old email-and-password pairs are still tried against major login pages every day.

Work rules

An employer may require a length, a rotation schedule, and MFA. Personal accounts should meet or beat that bar. Attackers connect personal and work identities through the email address.

If work requires a 90-day change, generate a new random password in the manager each cycle. Incrementing Summer2024 to Summer2025 is the pattern people fall into when the timer is the only reason to change.

A signup, start to finish

A new SaaS trial:

1. Open Password Generator at 16 characters, all character sets.
2. Generate, then copy into a vault entry.
3. Paste into the signup form. Let the manager save the login.
4. Turn on MFA in account settings before you import data.
5. Do not reuse this password on another trial because you plan to delete the account.

Trials get breached too. A disposable account with a reused password becomes access to work systems when the signup used a work email.

Mistakes that keep showing up

Sites that require one uppercase letter and one number produce Welcome1! on every account. The rule is satisfied. The password is still shared and guessable.

Skipping MFA because the password is long leaves stuffing and phishing in place. Strength does not block a site that asks the user to type the password into a fake page.

A master password on paper in the desk drawer is better than reuse. Anyone who can open the drawer still gets the vault.

Passkeys have not removed passwords. Until every account supports them, the password is the fallback.

What a password cannot stop

A password alone cannot stop:

• Phishing that captures an MFA code in real time. Use a hardware key on high-value accounts.
• A keylogger on a compromised device.
• Someone reading the screen in a public place.
• A database breach on the service side. You do not control how the provider stores the hash.

Unique passwords, MFA, a manager, and skepticism toward unsolicited login links cover different failures. You need the set.

Sources

• NIST SP 800-63B, Digital Identity Guidelines (Authentication): length, memorized secrets, and authenticator guidance
• CISA, Use Strong Passwords: unique passwords and password managers
• Password Generator: browser-side random password generation

Last reviewed: September 2026. Sources and scope checked for accuracy.

Related articles

• Two-Factor Authentication Basics
• Clipboard Security for Sensitive Data
• PDF Password Protection Explained
• Browser File Processing Risks

Generate long random secrets, store them in a manager, keep each one unique, and add MFA on the accounts that matter. The Password Generator supplies the entropy. Reused passwords, and weak patterns rotated on a timer, are still the fast path. Passkeys will take some of this work away over time. Until they cover the accounts you actually have, each signup needs its own credential.