Random passwords are the strongest for their length, but nobody can remember them. Use them with a password manager, which fills them in for you. Sixteen or more characters is plenty for almost anything.

Passphrases are strings of random words, like crane-oasis-tulip-spoon-mantle-fig. Six words are about as strong as a 10-character random password, and far easier to type on a phone or TV. Each extra word makes it about 1,300 times harder to guess. They're ideal for the few passwords you have to remember: your computer, your password manager, your email.

The words must be picked at random, not by you. People choose predictable words, and attackers know it. These come from the EFF's list of 1,296 short, easy-to-spell words.

The crack time assumes an attacker who has stolen a database and can test ten billion guesses a second. Use a different password for every site, and turn on two-step sign-in wherever you can. Passwords are generated by your browser's secure random number generator; nothing is sent to us or saved.