How to create a strong password
A password is the only lock on most accounts, and yet it is also the link that breaks most often. The secret of a strong one is not elaborate symbols but length and uniqueness.
Short answer
A strong password is long (preferably 12 characters or more), unguessable, and different for every account. A string of four or five unrelated words is generally stronger than something short but complicated. Rather than trying to remember them all, using a password manager is the most sustainable route.
What makes a password strong?
A password's strength depends on how long it would take to find by trial and error, and length is what decides that: every additional character multiplies the number of possible combinations. An eight-character complicated password can fall far faster than a plain sixteen-character string of words.
The second criterion is predictability. Birthdays, a child's name, a football club, keyboard patterns (123456, qwerty) and a single digit tacked on the end are the first patterns automated attack lists try. No password derived from your personal details counts as strong.
It is also misleading to picture attacks as being carried out by hand, one attempt at a time: password cracking is done by programs capable of millions of attempts per second. They start with ready-made lists compiled from leaks, then move to variations on common patterns. A short, pattern-based password can fall within minutes to that automated sweep, while a long, random string stays out of reach in practice.
The passphrase method
The practical way to produce a long password you can still remember is to string together four or five unrelated words: “lantern-pillow-cucumber-cloud”, for example. A string like this passes twenty characters and, being meaningless, holds up well against dictionary attacks.
When choosing the words yourself, avoid song lyrics, proverbs and famous lines; those appear in attack lists too. Sprinkling in a digit or a symbol does no harm, but remember that the strength comes from the length.
Watch out for your own mind's patterns as you choose: people who believe they are picking at random usually pick objects around them or concepts they are fond of. Opening a dictionary at random pages with your eyes shut, rolling a die to select from a list, or using your password manager's passphrase generator switches those invisible patterns off.
Why uniqueness is not negotiable
Using the same password in several places is like fitting every door with one key. If a data breach at any site exposes your email and password pair, attackers will automatically try that pair on hundreds of other sites. The technique is called credential stuffing, and it is among the most common causes of account takeover.
So for critical accounts in particular — email, banking, social media — the password must be unique. Your email account also deserves the strongest one, because it is the recovery door to all the others.
What a password manager does
Keeping dozens of long, unique passwords in your head is not realistic, and this is exactly the problem a password manager solves. These applications generate a random password for each account, store them encrypted, and fill them in for you at sign-in. The only thing you need to memorise is the manager's master password.
Create that master password with the passphrase method and never reuse it anywhere. Protecting the manager itself with two-factor authentication strengthens the chain at its start. The password-saving features built into browsers are also better than nothing as a beginning.
Three things are enough to look at when choosing a manager: that it runs on all your devices, that it stores data with end-to-end encryption, and that it comes from an established, known developer. Trustworthy options exist, including free and open-source ones; what matters is not which you pick but that you actually start using one.
Common mistakes
The most widespread mistake is finding one strong password and using it everywhere; the second is producing ever weaker versions in the rush to change passwords at regular intervals. Current thinking is to change a password only when a leak is suspected.
Writing a password on a note stuck to the edge of the screen, in an unprotected note on your phone, or in a message thread is much like hanging the key above the door. If you suspect one of your accounts has been taken over, you can follow the steps in the guide to a hacked account.
Checklist
- List your critical accounts (email, bank, social media)
- Give each one a unique password longer than 12 characters
- Install a password manager and build its master password as a passphrase
- Update, one by one, the older accounts sharing the same password
- Add two-factor authentication to your email account
- Drop the habit of writing passwords on paper or in messages
Frequently asked questions
How many characters is enough?
The common recommendation is at least 12 characters; for critical accounts, 16 and above is a safer starting point. As length grows, the time needed to break it grows exponentially.
Should I change my password regularly?
It is not required. Current security thinking recommends changing a password only in the event of a leak or suspicious activity. Frequent forced changes tend to push people towards weak and predictable patterns.
Is it not risky to trust a password manager?
No method is free of risk; but unique passwords held encrypted in a reputable manager are far safer than a single password reused everywhere. Provided you keep your master password strong, the balance is clearly in the manager's favour.
How do I know whether my password has leaked?
Many browsers and password managers compare your saved passwords against known breach lists and warn you. When such a warning appears, change the password concerned without delay.
This guide draws on the publicly issued password advice of national cyber security bodies and on current practice widely accepted in the security field.