How to Make Strong Passwords You Can Actually Manage
Most accounts are not broken into by clever hackers guessing your dog’s name. They are broken into because the same password was used on a website that leaked it. The good news: a few simple habits stop almost all of these attacks.
How passwords are really stolen
- Data leaks: a website is hacked and millions of email and password pairs are published. Attackers then try those pairs on email, banking and shopping sites. This is called credential stuffing.
- Guessing lists: attackers try the most common passwords first, like 123456, password, qwerty, names, birthdays and football teams.
- Phishing: a fake email or message leads you to a page that looks like your bank or email login.
- Brute force: a computer tries every combination. This only works quickly on short passwords.
Length matters more than strange symbols
Every character you add multiplies the number of possible passwords. A 12-character random password is billions of times harder to guess than an 8-character one. Security guidance from organisations such as the US National Institute of Standards and Technology (NIST) now puts length ahead of complicated rules.
Replacing letters with symbols, like “P@ssw0rd!”, helps much less than people think. Attackers’ software tries those substitutions automatically.
| Password | Strength |
|---|---|
| sunshine1 | Very weak: a common word plus a number |
| Sunsh1ne! | Weak: predictable substitutions |
| k7#Qm2vX | Too short: random, but only 8 characters |
| orbit kettle garden fifteen | Strong and easy to type |
| Zt^m*7vvpxQCN*,4 | Very strong: 16 random characters |
A simple system that works
- Step 1: Use a password manager. Chrome, Safari, Firefox, Android and iPhone all have one built in, for free. It remembers every password for you.
- Step 2: Let it (or our Password Maker) create a long random password for every website.
- Step 3: Protect the password manager itself with one strong passphrase you memorise: four to six random words.
- Step 4: Turn on two-step verification for your email, bank and social media, so a stolen password alone is not enough.
Your email password is the most important one
Almost every website lets you reset your password by email. That means whoever controls your email can take over everything else. Give your email account its own unique, strong password and turn on two-step verification there first.
Has my password already leaked?
You can check whether your email address appeared in a known data breach at haveibeenpwned.com, a free service run by a respected security researcher. If it has, change the password on that website and anywhere else you used the same one.