How to create a strong password

What makes a password strong

• Length beats complexity: 14 or more characters is a good target.
• It is random, not a word, name, date or keyboard pattern.
• It is unique to one account, so one breach cannot unlock others.

Swapping letters for look-alike symbols, such as a 0 for an O, adds almost no strength because attackers try those swaps first.

Generate one safely

1. Open the Password Generator.
2. Choose a length of 16 or more and the character types the site allows.
3. Copy the result straight into your password manager.

The password is created in your browser using its secure random generator and is not sent anywhere.

Keep it safe

• Use a password manager so you never have to remember or reuse passwords.
• Turn on two-step verification wherever it is offered.
• Never share passwords by plain email or chat.
• Use a strong one to lock sensitive files too, for example with Protect PDF.

Passwords versus passphrases

A passphrase is a string of several unrelated words, such as four or five picked at random. It is easy to type and remember, and its length makes it hard to guess. It is a good choice for the few passwords you must remember, such as the one for your password manager and for your computer. For everything else, let a manager generate a long random password.

What matters is that the words are really random. A famous line or a phrase from a song is far easier to guess than it feels.

Why reusing a password is the real danger

When a site is breached, attackers take the stolen email and password pairs and try them on other popular sites. This is called credential stuffing, and it works because many people reuse passwords. If every account has its own password, a breach at one site cannot open the others.

Protect the accounts that matter most

• Your main email account first. It can reset the passwords for almost everything else.
• Online banking and any payment accounts.
• Your phone account and your cloud storage, which often hold backups and photos.
• Social media and shopping accounts, which are often used to scam your contacts.

Turn on two-step verification on each of these. An authenticator app is stronger than text messages, because messages can be intercepted by someone who takes over your phone number.

If a password may have leaked

1. Change that password right away, and change it anywhere else you used it.
2. Turn on two-step verification if it is not already on.
3. Check the account for activity you do not recognise, such as new devices or changed recovery details.
4. Watch for phishing emails that mention the breach, and do not click links in them.

Common mistakes

• Using personal details such as a birthday, pet name or street. They are easy to find or guess.
• Making small changes to one password, like adding a number at the end. Attackers try these first.
• Answering security questions truthfully. Treat the answers as extra passwords and store them in your manager.
• Sending passwords by plain email or chat.

A password written down and kept somewhere private at home is better than a password reused on ten sites, but a password manager is safer and easier.

Frequently asked questions