How to Create a Strong Password You Can Actually Use

How passwords get cracked

Attackers rarely sit and guess by hand. Their usual methods are automatic:

• Reused passwords: they take email and password pairs leaked from one website and try them on many others.
• Common guesses: they try lists of millions of popular passwords and known patterns first.
• Brute force: when a website's password database is stolen, computers test huge numbers of guesses offline.
• Phishing: a fake login page tricks you into typing the password yourself.

Length matters most

Every extra character makes a password much harder to guess. Aim for at least 16 characters on important accounts such as your email and bank. A long password beats a short one full of symbols.

The numbers show why. Eight random lowercase letters give about 209 billion combinations. Sixteen random lowercase letters give about 44 sextillion, roughly 200 billion times more, just from doubling the length.

Imagine an attacker who can test 100 billion guesses a second, which is possible when a site has stored passwords poorly. The 8-letter password would fall in about two seconds. An 8-character password using every keyboard character would last under a day. The 16-letter password would take around 14,000 years. Well-run websites slow attackers down far more than this, but you can't see how any website stores your password, so plan for the worst.

Make it random

People are bad at being random. Attackers know the common tricks, like swapping "a" for "@" or adding "123" at the end. A password made by a secure random generator avoids those patterns.

A password can look complicated and still be weak. P@ssw0rd! meets most website rules, yet it is just a common word with well-known swaps, and it is near the top of the lists attackers try first. Strength comes from how the password was made, not how odd it looks.

Avoid personal details

Never build a password from things people could find out about you:

• Your name, or the names of family and pets.
• Your birthday or phone number.
• Your favorite team, city or band.
• Words like "password" or number runs like "123456".

Try a memorable passphrase

For the few passwords you must type from memory, use several random words joined together, with a number and a symbol. The words must be picked at random. A phrase you chose yourself, like a song lyric, is far easier to guess.

The strength comes from the number of words. The Memorable tab on Flash picks from about 900 words. Four random words give about 640 billion combinations, six give about 500 quadrillion, and eight give over 400 sextillion. Use at least six words for anything important, and eight for a password manager's master password.

Adding your own word makes a passphrase feel more personal, but it adds no real strength, so count only the random words.

Which should you use?

A simple way to choose:

• Saved in a password manager: a random password of 16 to 20 characters. You never need to remember it.
• Typed from memory, such as a phone or laptop login or a master password: a random passphrase of six to eight words.
• A site with an odd rule on length or symbols: use the longest password it allows, then adjust the settings to fit.

Use a different password for every account

When one website is hacked, attackers try the leaked password on other sites. If every password is different, one leak stays one problem. A password manager makes this easy, because it remembers everything and you only need one master password.

If an app feels like too much, start with the password manager built into your phone or browser. It is much safer than reusing the same password everywhere.

Turn on two-step login

Two-step login asks for a code from your phone as well as your password. Even if a password leaks, that extra step helps keep attackers out. Turn it on for your email first, since email is used to reset your other accounts.

An authenticator app is safer than a text message code, and a text code is still far better than nothing. When you set it up, save the recovery codes somewhere safe, so that a lost phone doesn't lock you out.

When you should change a password

You don't need to change strong passwords on a schedule. The US standards body NIST advises against forcing regular changes, because people tend to respond with small, predictable edits. Change a password when there is a reason: a website reports a breach, you shared it with someone, you typed it on a suspicious page, or you notice activity you don't recognize.

Free services such as Have I Been Pwned let you check whether your email address has appeared in a known data breach.

What about passkeys?

Many large services now offer passkeys, which let you sign in with your fingerprint, face or phone PIN instead of a password. A passkey is tied to the real website, so it can't be typed into a fake one. If an account offers passkeys, it is worth turning them on. You will still need good passwords for the many sites that don't offer them yet.

A simple plan for today

You don't have to fix everything at once. Start with the accounts that matter most:

• Set up a password manager.
• Change your main email password, and turn on two-step login.
• Do the same for banking, then social media and shopping accounts.
• Update other accounts whenever you next log in to them.