How to create a strong password (and remember it)

How to create a strong password: length beats complexity

Attackers don't guess passwords one at a time. They use software that tries billions of combinations, starting with leaked passwords, common words and predictable patterns like "Summer2026!" or "P@ssw0rd". Swapping a letter for a symbol barely slows that software down. Adding length does.

A good target for an important account is at least 15 characters. Every extra character multiplies the number of possibilities, so a long password made of simple parts is far stronger than a short, complicated one.

How to make a strong password you can remember: use a passphrase

A passphrase is a string of random, unrelated words. It's long, which makes it strong, and it's a picture you can remember, which makes it usable.

• Use four to six words, picked at random. Many password managers can generate a passphrase for you.
• Don't use song lyrics, quotes, or facts about you such as names, birthdays or your street. Those are guessable.
• Spaces or hyphens between words are fine if the site allows them.

Strong password tips: never reuse a password

Reuse is the single biggest password risk. Websites get breached all the time, and attackers automatically try leaked email and password pairs on email, banking and shopping sites. This is called credential stuffing. If you reuse a password, one breach anywhere can open every account that uses it.

A unique password for every account means a breach stays contained to that one site.

How do I make a strong password for every account? Use a password manager

Nobody can remember dozens of long, unique passwords. A password manager remembers them for you, fills them in, and generates new ones. You only need to remember one strong passphrase to unlock it.

• Options include managers built into your browser or phone, and standalone apps. There are good free and paid choices; we don't endorse any particular one.
• Look for one that works on all your devices, can generate passwords, supports two-factor authentication for the manager itself, and warns you about reused or leaked passwords.
• For teams, choose one that lets you share passwords securely instead of sending them by email or chat.

Protect your password manager and your email account most of all: use a long passphrase and turn on two-factor authentication for both.

Add two-factor authentication

Even a perfect password can be stolen by a fake login page or malware. Two-factor authentication (2FA) adds a second step, such as a code from an app or a security key, so a stolen password alone isn't enough. Read two-factor authentication explained to set it up.

Check whether your password has leaked

• Have I Been Pwned shows whether your email address appears in known data breaches.
• Its Pwned Passwords check tells you whether a password appears in breach data, without sending the full password over the internet.
• Many password managers and browsers check your saved passwords against breach data automatically.

If a password shows up, change it on every account where you used it, starting with email and banking.

Should I change my passwords regularly?

Not on a fixed schedule. Current guidance, including from the US standards body NIST, is that forcing people to change passwords every few months leads to weaker, predictable passwords like "Spring2026!" becoming "Summer2026!".

Change a password when there's a reason to: it appears in a breach, you typed it into a site you're not sure about, someone else may have seen it, or someone who knew it has left your organisation.

Passwords for shared and team accounts

Small organisations often have accounts several people use, like the social media profile, the website admin or the shared mailbox. A few habits keep these safe:

• Where the service allows it, give each person their own login instead of sharing one. Then you can remove one person without changing everyone's access.
• If a login has to be shared, share it through a password manager's sharing feature, not by email, chat or a document.
• Turn on two-factor authentication for shared accounts too, and agree who holds the second factor.
• Change shared passwords when someone who knew them leaves.

Strong password mistakes to avoid

• Short passwords with a predictable pattern, such as a word with a capital letter, a number and a ! at the end.
• Personal details: names, birthdays, pets, your organisation's name.
• Changing only one character when you're asked to change a password.
• Writing passwords in a spreadsheet, email or sticky note on the screen.
• Sharing one login between several people instead of giving each person their own account.