Most of us have been told to make passwords complicated, with a capital letter, a number and a symbol. The result is often something like "Summer2026!", which is hard to remember and surprisingly easy to guess. Modern security advice focuses on something simpler: make passwords long and unique.
Why length matters most
Every extra character multiplies the number of guesses an attacker needs. A random 8-character password can be cracked quickly by modern hardware, while a random 16-character password is far beyond practical attacks. Predictable tricks, like swapping "a" for "@", are already built into cracking tools.
Build a passphrase
A passphrase is several unrelated words joined together, for example copper-violin-harbor-flash. It is long, easy to picture and very hard to guess. Follow these rules:
- Pick four or five words at random. Do not use a quote, a song lyric or a phrase from your life.
- Avoid names, birthdays and anything that appears on your social media.
- Add a number or symbol only if a website insists.
Never reuse passwords
When a website is breached, attackers try the leaked email and password on other popular sites. If you reuse a password, one breach can unlock your email, shopping and banking. Use a different password for every account.
Use a password manager
Nobody can remember dozens of unique passwords. A reputable password manager stores them in an encrypted vault, fills them in for you and can generate random ones. You then only remember one strong master passphrase.
Turn on two-step verification
Two-step verification asks for a second proof, such as a code from an app or a security key, in addition to your password. Even if someone learns your password, they cannot easily get in. Start with your email, because email can reset all your other accounts.
Warning signs to act on
- You receive a password-reset email you did not request.
- A service announces a data breach.
- You see logins from places or devices you do not recognise.
Change the password straight away and enable two-step verification. You can create a random one with our free Strong Password Generator, which runs in your browser and never stores anything.
Frequently asked questions
How often should I change passwords?
You do not need to change strong, unique passwords on a schedule. Change them if there is a breach or a sign of trouble.
Is writing passwords on paper safe?
A paper list kept somewhere private at home is safer than reusing one password, but a password manager is better.
This guide is for general information only. See our disclaimer.