How to Create and Manage Strong Passwords (Without Going Mad)

Almost every account you own is protected by a password, and most breaches that affect ordinary people come down to weak or reused ones. The good news is that good password habits are simple once you know what actually matters. This guide explains what makes a password strong and how to manage dozens of them without a headache.

What makes a password strong?

Strength is mostly about how many guesses an attacker would need. Two things drive that number: length and randomness.

• Length beats complexity. Every extra character multiplies the number of possible combinations. A random 16-character password is vastly harder to crack than an 8-character one with symbols.
• Randomness beats cleverness. "P@ssw0rd!" follows a pattern attackers try first. Substituting @ for a or 0 for o barely helps.
• Uniqueness. A strong password reused on two sites is only as safe as the weaker site.

As a rough guide, a random password with upper and lower case letters, numbers and symbols has about 94 possible characters per position. At 16 characters that is around 10³¹ combinations. You can generate one instantly with our Password Generator, which builds passwords with your browser's cryptographically secure random number generator.

Passphrases: strong and memorable

A passphrase joins several random words, for example coral-ladder-mango-thunder-quiet. Four or more truly random words are long enough to be very strong and much easier to remember than a jumble of symbols. The words must be chosen randomly; a famous quote or song lyric is not random and is much weaker. The generator has a Memorable mode for this.

Use a password manager

Nobody can remember dozens of unique random passwords, and nobody should try. A password manager stores them in an encrypted vault protected by one strong master password. It fills passwords in automatically and can warn you about reused or leaked ones. Choose a reputable manager, make the master password a long passphrase that you have never used anywhere else, and keep a recovery method safe.

Turn on two-factor authentication

Two-factor authentication (2FA) asks for a second proof, such as a code from an authenticator app or a hardware key, in addition to your password. Even if a password leaks, an attacker cannot log in without the second factor. Prefer an authenticator app or security key over SMS codes when the option exists, and switch it on for email, banking, cloud storage and social media first.

Common mistakes

1. Reusing passwords. When one site is breached, attackers try the same login everywhere else.
2. Using personal information. Names, birthdays and pet names are easy to guess or find online.
3. Adding a number to the end to satisfy a rule, like Summer2024.
4. Sharing passwords by email or chat.
5. Ignoring breach notices. If a service tells you it was breached, change that password and any other place you used it.

A note on hashing

Well-run websites never store your password itself. They store a hash, a fingerprint produced by a one-way function. Fast, old algorithms such as MD5 are no longer safe for this purpose, while modern password hashing uses slow, salted algorithms such as bcrypt or Argon2. If you are curious how hashes look, try the SHA-256 Hash Generator, and remember that hashing is not the same as encryption or encoding (see the Base64 tool for an example of encoding that offers no secrecy at all).

A simple routine

1. Install a reputable password manager.
2. Set a long passphrase as its master password and switch on 2FA for it.
3. Change your most important accounts first (email, banking) to unique, generated passwords.
4. Work through the rest over the next few weeks.
5. Review your saved logins once or twice a year.

Good password hygiene takes an afternoon to set up and protects you for years.