How do I create a strong password?

The traditional advice — a short password with substitutions like P@ssw0rd1 — produces passwords that are hard for people to remember and easy for computers to guess. Length and unpredictability are what matter, and reuse is the vulnerability that actually gets exploited.

What you'll need

• Password manager
• Notebook stored securely (optional)

Step by step

1. Understand that uniqueness matters more than strength.Most account compromises come from credential stuffing — a password breached elsewhere being tried on your other accounts. A unique password stops that regardless of its strength.
2. Use a password manager to generate and store unique passwords.You do not need to remember them, so they can be long and random. This is the actual solution.
3. For the passwords you must remember, use three or four random unrelated words.Length beats complexity. A long passphrase is both stronger and easier to recall than a short complex string.
4. Make sure the words are genuinely random rather than a phrase.A quotation or song lyric is guessable. Unrelated words picked at random are not.
5. Make your password manager's master password the strongest one you have.It protects everything else. This is the one that has to be genuinely strong and genuinely memorable.
6. Never reuse a password across sites, even a strong one.One breach anywhere exposes every account using it.
7. Do not use personal information.Names, birthdays, pets and addresses are often publicly discoverable and are the first things tried.
8. Enable two-factor authentication wherever it is offered.It protects the account even if the password is compromised, which is why it matters more than password complexity.

Tips

• Answer security questions with random text stored in your password manager rather than real answers. Real answers are frequently discoverable online.
• Passkeys are replacing passwords on major services and cannot be phished or reused. Enable them where offered.
• Frequent forced password changes are no longer recommended by most security guidance — they push people towards predictable variations. Change on evidence of compromise instead.

Common mistakes

• Reusing passwords — It is the vulnerability that is actually exploited at scale. One breach anywhere exposes every account sharing that password.
• Using substitutions like @ for a — Password-cracking tools account for these. They add almost nothing while making the password harder to remember.
• Basing a password on personal information — Names, dates and pets are often publicly available and are tried first.

Questions people ask