A strong password is long, unique and hard to guess: aim for at least 14 to 16 characters, never reuse it, and store it in a password manager. Length matters more than clever tricks, and a different password for every account matters most of all.
Passwords protect your email, bank, work accounts and photos. Yet many people still use short, familiar words with a number at the end. Attackers know these habits well. This guide explains what makes a password strong and how to manage dozens of them without going mad.
Key takeaways
- Make passwords long. A passphrase of several random words is strong and easier to remember.
- Use a different password for every account, so one leak cannot open everything.
- Let a password manager remember them, and protect that manager with one strong passphrase.
- Turn on two-factor authentication wherever you can, especially for email and banking.
What makes a password strong?
Think about how passwords are broken. Attackers rarely sit and guess by hand. They use programs that try millions of combinations, starting with the most common words, names, dates and patterns. A strong password survives this because it is not predictable.
Three things matter most:
- Length. Every extra character multiplies the number of possible combinations. A long password is much harder to crack than a short one with symbols.
- Randomness. Passwords built from your name, pet, birthday or a favourite football team are guessable. Truly random choices are not.
- Uniqueness. If you use the same password on many sites and one site is hacked, attackers will try that password on your other accounts.
Passwords to avoid
Do not use any of these, even with small changes:
- Common choices such as «password», «123456», «qwerty» or «letmein»
- Your name, family names, pets, birthday or address
- Simple substitutions like «P@ssw0rd», because attackers include them in their lists
- Keyboard patterns such as «1qaz2wsx»
- Old passwords with a new number at the end
- The same password on several websites
Passwords versus passphrases
A passphrase is a password made of several unrelated words, for example four or five random words joined together. Because it is long, it is strong, and because it is made of words, it is easier to remember and type.
The key is that the words must be random. A famous quote or song lyric is not a good choice, because people can guess it. Choosing words by using a random generator is much better than picking your favourite ones.
For most accounts, you do not need to remember anything. Create a long, random password and let your password manager store it. Passphrases are best for the few things you must type from memory, such as your device login and the master password of your password manager.
How to create a strong password in seconds
The easiest approach is to let a tool do the random choosing for you. Open the password generator, choose the length, and select the types of characters you want. A length of 16 or more is a good starting point for important accounts. The password is created in your browser on your own device, so it is not sent anywhere.
Some websites limit the length or reject certain symbols. If that happens, use the longest password the site allows, and include letters and numbers if symbols are not accepted.
If you want to check the length of a passphrase or a password that you plan to use, the word counter shows the number of characters. Do not paste real passwords into tools you do not trust, though, and delete anything you pasted for a test.
Store passwords safely
Nobody can remember dozens of long random passwords, and that is fine. These are the safer options:
- A password manager. It creates, stores and fills in passwords for you. Protect it with a long master passphrase and two-factor authentication.
- The built-in manager of your browser or phone. This is much better than reusing one password, though you should lock your device with a strong code.
- Paper, kept somewhere safe at home. Not glamorous, but it can be fine for a few key accounts, as long as no one else can find it.
Avoid saving passwords in a plain document on your desktop, in an email to yourself or in a chat. These are easy for attackers and for curious people to find.
Add a second layer: two-factor authentication
Even a strong password can be stolen, for example through a fake website. Two-factor authentication (2FA) adds a second step, such as a code from an app or a security key. An attacker who has your password still cannot get in without that second item.
Turn on 2FA first for your main email account, because it can be used to reset the passwords of other services. Then enable it for banking, social media, cloud storage and work accounts.
Good habits to keep
- Change a password immediately if you think it has been exposed or if a service reports a breach.
- Do not share passwords by email or chat. Use the sharing feature of a password manager when you need to share.
- Be careful with links in messages that ask you to log in. Open the site yourself instead.
- Do not enter passwords on public computers.
- Update the recovery email and phone number on important accounts.
If this feels like a lot, start small. Today, set up a password manager, change the password of your email account to a long unique one, and switch on two-factor authentication there. You can improve the other accounts one by one over the next weeks.
Frequently asked questions
How long should a password be?
For important accounts, at least 14 to 16 characters is a good general target. Longer is better, especially for a password manager or an email account.
Do I need to change my passwords regularly?
Not necessarily on a fixed schedule. It is more useful to use strong, unique passwords and change them when there is a reason, such as a breach or suspicious activity.
Is a password generator safe?
A generator that runs in your browser creates the password on your device without sending it to a server, which is a good approach. Still, store the result in a password manager.
Are password managers safe?
They are widely recommended by security experts as far better than reuse or weak passwords. Choose a well-known one, use a strong master passphrase and enable 2FA.
