How to create a strong password
Short answer
A strong password is long, unpredictable and unique to each account. Use a random password of at least 14-16 characters or a multi-word passphrase, and add a password manager and two-step verification.
Checklist
- At least 14-16 characters
- A different password for each account
- Contains no personal information
- Saved in a password manager
- Two-step verification enabled
Passwords are the first line of defense for your accounts. The secret to a strong one is not looking complicated, but being long, unpredictable and not used anywhere else.
Key features of a strong password
- Length: The more characters, the harder it is to guess by trial. Aim for at least 14-16 characters.
- Unpredictability: Avoid names, birth dates, phone numbers, pet names or common patterns such as “123456” and “password”.
- Uniqueness: Use a different password for every account. If one site is breached, attackers try the same password on other accounts.
- Randomness: Attackers know common tricks like replacing “a” with “@”. True randomness is safer.
Creating a password step by step
- Choose a methodPick either a random character password or a passphrase of 4-6 unrelated words.
- Generate it randomlyUse your password manager's generator. For the word method, pick words randomly, for example with dice or a generator; do not use a famous quote or song lyric.
- Keep it longA passphrase is both easy to remember and long, which suits important passwords such as a master password.
- Store itSave the password in a trusted password manager; do not write it on paper or in plain-text notes.
- Add extra protectionTurn on two-step verification wherever it is available.
Mistakes to avoid
- Reusing the same password on multiple accounts
- Just adding “1” or “!” to the end of a password
- Sharing passwords by email, messaging apps or screenshots
- Telling your password to anyone, even someone posing as support staff
Frequently asked questions
Should I change my password regularly?
If your password is strong, unique and there is no sign of compromise, frequent changes are not required. If you suspect a leak, change it right away.
Are special characters mandatory?
No; length matters more. Some sites may require them, though, in which case meet the requirement.
Does two-step verification replace a password?
No, it is an additional layer on top of the password. Using both together is the safest approach.
Have a question or spotted a mistake?
Write your question or the error you noticed; our editors will review it. Messages are not published.