How to Create Strong Passwords You Can Actually Manage

What makes a password weak

Most weak passwords are weak for predictable reasons: they are short, based on personal facts like names and birthdays, built from common words with simple substitutions such as '@' for 'a', or reused across several sites. Attackers use lists of leaked passwords and common patterns, so anything guessable falls quickly.

Reuse is the biggest everyday danger. When one site is breached, the same email and password are tried on many others.

Length beats complexity

A long password of random characters or several unrelated words is much harder to crack than a short one with a few symbols. Rules that force a capital, a number and a symbol often lead people to predictable tricks like adding '1!' at the end.

Aim for length and randomness. If a site limits the length or characters, use the maximum it allows and prefer a generator over inventing something yourself.

• Make it long.
• Make it random, not clever.
• Make it unique for every account.
• Never share it by chat or email.

Generate a password step by step

With the Password Generator:

• Choose the length. Longer is better unless the site limits it.
• Select which character types to include if the site requires specific ones.
• Generate and copy the password.
• Save it straight into your password manager before you close the page.

Use a password manager

Nobody can remember dozens of long random passwords, and they should not have to. A reputable password manager stores them encrypted behind one strong master password, fills them in for you and warns you about reuse. Choose a well-known product, read its security documentation and protect the master password carefully.

Some browsers and operating systems have built-in managers too. They can be convenient, but consider how you would recover access if you lose a device.

Add two-factor authentication

Even a strong password can leak through a breach or phishing. Two-factor authentication adds another hurdle. An authenticator app or a hardware security key is generally stronger than codes sent by text message, though any second factor is better than none.

Prioritise your email, banking, cloud storage and social accounts, because email in particular is often used to reset other passwords.

Spotting phishing

Strong passwords do not help if you type them into a fake site. Be careful with links in unexpected messages, check the web address before logging in and be suspicious of urgent threats. A password manager helps because it normally will not fill in a password on a look-alike domain.

If you think a password has been exposed, change it immediately and anywhere else it was used.

Passwords you still have to remember

A few passwords cannot live in a manager, such as the master password itself, your device login and perhaps your email. For these, a passphrase made of several random words is a good compromise: long, unusual and easier to recall than a string of symbols. The words should be chosen randomly, not from a quote, song lyric or phrase connected to you.

Make the passphrase longer rather than fancier. Adding another random word helps more than replacing a letter with a number. Practise typing it a few times so it becomes muscle memory, and then avoid writing it down where others can find it. If you do keep a written backup, store it somewhere physically secure.

Never reuse these important passwords anywhere else. If any one of them is leaked, an attacker will try it on your other accounts first, so keeping them unique contains the damage to a single place.

A simple routine to start today

Begin with your most important accounts: email, banking and anything linked to your phone number. Create a unique generated password for each, save them in your manager, and switch on two-factor authentication. Then work through the rest over a few days.

Small steady changes beat a perfect plan you never finish.