How to Create a Strong Password and Stay Safe Online

Most account break-ins happen because of weak or reused passwords. A few habits make you much harder to attack.

What makes a password strong

• Length: aim for at least 12 to 16 characters. Longer is better.
• Randomness: avoid names, birthdays and keyboard patterns such as 123456 or qwerty.
• Uniqueness: never reuse a password across sites.

Passphrases

A passphrase made of several unrelated words is easier to remember and still strong. Adding a few numbers or symbols between the words helps further.

Use a password manager

Nobody can remember dozens of long random passwords. A reputable password manager stores them securely, and you only need to remember one strong master password.

Add a second step

Turn on two-factor authentication for email, banking and social media. Even if a password leaks, the attacker still needs your second factor.

Watch out for phishing

Do not enter your password after clicking a link in a message. Open the website yourself and check the address carefully.

How accounts get attacked

Attackers use three main methods. In credential stuffing, they try passwords leaked from one website on many others. In brute force attacks, software guesses many combinations. In phishing, a fake page tricks you into typing your password. Long, unique passwords and two-factor authentication defend against all three.

If an account is breached

1. Change the password immediately, and on any other site that used it.
2. Turn on two-factor authentication.
3. Check recent activity and sign out of all devices.
4. Watch for suspicious messages sent from the account.

Habits to avoid

• Sharing passwords through chat apps.
• Saving passwords in the browser on shared computers.
• Using the same password for email and social media.

Frequently asked questions

Should I change passwords regularly?

Current guidance, including from NIST, is to change a password when you suspect it is compromised, not on a fixed schedule.

Is SMS two-factor enough?

It is better than nothing, but an authenticator app is stronger because text messages can be intercepted.

Generate a random password in your browser with our Password Generator. Nothing you generate is sent to us.