A strong password is long, unique to each account, and hard to guess. The easiest way to make one you can remember is a passphrase: four or more random words strung together, like maple-trumpet-gravel-sunrise. Use a different password for every account, store them in a password manager, and turn on two-factor authentication for important accounts.
Quick Summary
- Use at least 16 characters where supported, with a unique random password or passphrase.
- Never reuse a password across accounts.
- Avoid personal details like names, birthdays, and pet names.
- Use a password manager to remember them for you.
- Turn on two-factor authentication (2FA).
What Makes a Password Weak
- Short passwords are easier to crack.
- Common ones like “password123” or “qwerty” are among the first guesses.
- Personal info like your kid’s name or birthday can be found on social media.
- Simple swaps like “P@ssw0rd” are well known to attackers.
- Reused passwords mean one data breach can expose many accounts.
Method 1: Create a Passphrase
A passphrase uses randomly chosen words to combine length with easier recall. Length alone does not make a predictable phrase strong.
- Pick four or more random, unrelated words. Avoid famous quotes or song lyrics.
- Combine them with a separator, like dashes or spaces if the site allows.
- Add a number or symbol if the site requires it.
Examples (do not use these exact ones):
- copper-banjo-meadow-pickle
- Lantern7-Orbit-Velvet-Crayon
Picture a silly scene with the words to make them stick, like a banjo made of copper in a meadow full of pickles.
Method 2: Use a Password Generator
Password managers and many browsers can generate long, random passwords like t9#Lq2vR!pX8wZ4&mK. You do not need to remember them because the manager fills them in. Generate a fresh password for each account; do not use the example shown here.
Use a Password Manager
A password manager is an app that stores all your passwords in an encrypted vault. You remember one strong master password, and it handles the rest.
Benefits:
- A unique, strong password for every site
- Autofill on your phone and computer
- Alerts when a password is weak, reused, or found in a breach
Options include standalone apps and the managers built into iPhone, Android, and major browsers. Choose a well-known, reputable one. Make your master password a long passphrase, and do not reuse it anywhere.
Turn On Two-Factor Authentication
Two-factor authentication (2FA) adds a second step when you log in, such as a code from an authenticator app, a text message, or a security key. This makes a stolen password less useful, but phishing and stolen sessions can still compromise some forms of 2FA.
Turn it on first for your:
- Email (it can reset all your other passwords)
- Bank and payment accounts
- Social media accounts
- Cloud storage and photo backups
Authenticator apps are generally more secure than text message codes. Save the backup codes the site gives you in a safe place.
Consider Passkeys
Many websites now support passkeys, which let you sign in with your phone’s fingerprint, face recognition, or device PIN instead of a password. Passkeys are designed to resist phishing. If a site you trust offers them, they are worth trying.
Password Habits to Build
- Change passwords after a breach. If a company you use reports a breach, change that password right away.
- Do not share passwords by text or email. Many managers have secure sharing features.
- Watch for phishing. Do not enter your password from a link in an unexpected email or text. Go to the site directly.
- Lock your phone with a PIN or biometric.
What About Writing Passwords Down?
A password manager is better, but if you write a password down, store it somewhere secure at home, never on a sticky note on your monitor or in your wallet.
If you are tidying up your digital life, also check out how to back up phone photos and how to free up iPhone storage.
FAQ
How long should a strong password be?
Aim for at least 16 characters where the service allows it. Use random characters or unrelated random words, and make every account’s password different.
Are password managers safe?
Reputable managers encrypt your data and are generally much safer than reusing passwords. Protect yours with a strong master password and 2FA.
How often should I change my passwords?
Change them if there is a breach or you suspect someone knows them. Unique, strong passwords do not need frequent changes otherwise.
Is a passphrase really safer than a complex short password?
A long passphrase of random words is generally strong and much easier to remember.
Leave a Reply