Your passwords are the keys to your email, bank, social media and work accounts. Yet many people still protect them with a pet name, a birthday or the same short phrase used everywhere. Attackers know this, and they use automated tools that can test billions of guesses against stolen password databases. The good news is that a few simple habits make you a much harder target. Here are ten tips you can start using today.
1. Make It Long
Length is the single most important factor. Every extra character multiplies the number of combinations an attacker must try. A random eight-character password can fall to modern hardware in hours, while a random password of 16 characters or more is out of reach for practical guessing attacks. As a rule of thumb, use at least 14 to 16 characters for important accounts and longer where the site allows it.
2. Use a Different Password for Every Account
When a website suffers a data breach, criminals take the leaked emails and passwords and try them on other sites. This is called credential stuffing, and it works because so many people reuse passwords. If every account has its own password, a breach at one service cannot unlock the others. Start with your most valuable accounts: email, banking, cloud storage and your phone provider.
3. Prefer Randomness Over Cleverness
Humans are predictable. We replace a with @, add a 1 at the end or capitalize the first letter, and attackers build those habits into their guessing rules. A truly random password has no pattern to exploit. The easiest way to get one is to let a tool create it for you. Our free Password Generator uses your browser's cryptographic random number source and runs entirely on your device, so the password is never sent anywhere.
4. Consider a Passphrase for the Ones You Must Remember
You cannot memorize dozens of random strings, but you can memorize a few. For your password manager's master password or your computer login, use a passphrase made of four or more unrelated words chosen at random, such as "maple orbit kettle drizzle". It is long, easy to type and easy to recall, and it is far stronger than a short complex password. Do not choose a famous quote, a song lyric or words that relate to each other in a way people could guess.
5. Use a Password Manager
A password manager creates, stores and fills in unique passwords for every site, so you only remember one strong master password. Good managers encrypt your vault before it leaves your device, warn you about reused or leaked passwords and work across phones and computers. Browser-built-in managers are better than reusing passwords, and dedicated managers add extra features such as secure sharing and breach monitoring.
6. Turn On Two-Factor Authentication
Even a strong password can be stolen by a fake login page or by malware. Two-factor authentication (2FA) adds a second proof, such as a code from an authenticator app, a hardware security key or a passkey. Then a stolen password alone is not enough. Where possible, choose an authenticator app or a security key over text messages, because SIM-swapping attacks can intercept SMS codes. Enable 2FA first on email, because email can reset almost every other account.
7. Avoid Personal Information
Names of family members, pets, your hometown, your phone number and your birth year are easy to find on social media and are among the first things an attacker will try. The same applies to keyboard patterns such as qwerty or 123456 and common words with minor changes. Security questions are a similar weak spot: if a site asks for your mother's maiden name, consider entering a random answer stored in your password manager.
8. Check Whether Your Passwords Have Leaked
Passwords can be exposed even when you did everything right, because the site itself was breached. Use the breach-monitoring feature in your password manager or a reputable breach-notification service to find out if your email address appears in known leaks. If a password has leaked, change it immediately everywhere you used it, and change any similar variants too.
9. Beware of Phishing
The strongest password in the world is useless if you type it into a fake website. Phishing messages pretend to come from your bank, a delivery company or your employer and urge you to act quickly. Before you log in, check the address in the browser bar, avoid clicking login links in unexpected messages and go to the site directly instead. A password manager helps here, because it will not autofill on a look-alike domain.
10. Update Passwords When It Matters, Not on a Schedule
Older advice told people to change passwords every 90 days. Current guidance from security organizations is different: forced regular changes encourage weak, predictable patterns. Change a password when you have a reason, such as a breach notice, a suspicious login, a lost device or sharing it with someone temporarily. Otherwise, a long, unique password protected by 2FA can safely stay in place.
Putting It Into Practice
You do not need to fix everything in one afternoon. Begin with your email account, because it is the master key to resets. Generate a new random password, store it in a password manager and turn on two-factor authentication. Then move on to banking, shopping and social media. In an hour or two, you can dramatically improve your online security. Try the Password Generator to create your first strong password, and read our Disclaimer for notes on how security tools should be used.