Start with the account itself, not a password manager

To change your password, log into the account on its official website or app, then look for settings or account security. The exact path depends on which service you use — Gmail, Facebook, your bank, your email provider — but the principle is the same: you change it where you log in, not anywhere else.

Do not use a password reset link sent to your email unless you have forgotten the password entirely. If you still remember it, use the "change password" or "update password" option in your account settings instead. This keeps you in control and confirms you are on the real website, not a fake one designed to steal your credentials.

Change your password from a device you trust — a computer or phone you use regularly, not a public computer or borrowed device. If you are using a password manager like Bitwarden, 1Password, or Dashlane, it will usually prompt you to update the saved password after you change it. If it does not, update it manually so the manager stays in sync with the real password.

Key Takeaways

  • Change your password by logging into the account and finding the security or settings section, not by using a password reset link unless you have forgotten it.
  • Use a strong password that is at least 12 characters long and includes uppercase letters, numbers, and symbols — or use a password manager to generate one for you.
  • Change passwords on accounts that hold sensitive information (email, banking, social media) at least once a year, and when ready if you suspect the account has been compromised.
  • After you change a password, update it in your password manager or anywhere else you have saved it, so you do not get locked out next time you try to log in.

What makes a password actually strong

A strong password is long and random. Aim for at least 12 characters, though 16 or longer is better. It should include uppercase letters, lowercase letters, numbers, and symbols — something like Tr0pic@lThund3r! or Qu1ckSilv3r#Moth.

Do not use words from the dictionary, even if you mix in numbers and symbols. Hackers have lists of common words and common substitutions (like replacing "a" with "@"). Do not use your name, your pet's name, your birthday, or anything else someone could guess or find on your social media. Do not reuse the same password across multiple accounts — if one site is breached, attackers will try that password on your email, your bank, and everywhere else.

If you cannot remember a strong random password, use a password manager. Managers like Bitwarden (free), 1Password, Dashlane, or LastPass generate passwords for you and store them encrypted. You only have to remember one strong master password to unlock them all. This is safer than writing passwords down or reusing straightforward ones you can remember.

How to change passwords on the most common accounts

Gmail: Go to myaccount.google.com, click "Security" on the left, scroll to "How you sign in to Google," and click "Password." You will be asked to sign in again, then you can enter your new password.

Facebook: Click the menu icon (three lines) in the bottom right on mobile, or the down arrow in the top right on desktop. Go to Settings & Privacy, then Settings. Click "Password" on the left side and enter your current password, then your new one.

Microsoft (Outlook, OneDrive, Xbox): Go to account.microsoft.com, click "Security" on the left, then "Change your password." Sign in again and enter your new password.

Apple (iCloud, App Store): On an iPhone or iPad, go to Settings, tap your name at the top, then "Password & Security," then "Change Password." On a Mac, go to System Settings, click your name, then "Password." You will need to enter your current password first.

Amazon: Go to amazon.com, click the account menu (your name or "Account & Lists"), then "Login & Security." Click "Edit" next to "Password" and enter your current password, then your new one.

Your bank or credit union: Log into your online banking portal, look for "Settings," "Security," or "Profile," and find the password change option. If you cannot find it, call the number on the back of your card — the bank's phone line is always legitimate, while a website link in an email might not be.

When to change your password right away

Change your password when ready if you receive a notice from the company saying your account was compromised or if you see activity you do not recognize — logins from places you have never been, purchases you did not make, or emails sent from your account that you did not send.

Also change it if you used the same password on another site that was breached. You can check whether your email address appears in a known breach by visiting haveibeenpwned.com and typing in your email. If it shows up, change the password on that account and any other account where you used the same password.

Change your password if you shared it with someone (a family member, a tech support person, a friend) and that person no longer needs access. Change it if you typed it on a public computer, a borrowed device, or a computer you suspect might have malware. Change it if you wrote it down and lost the paper, or if someone watched you type it.

What to do if you cannot log in after changing your password

If you changed your password and now cannot log in, first check that you are typing it correctly. Passwords are case-sensitive, so "Password123" is different from "password123." If you are sure you are typing it right, try the "Forgot Password" link on the login page. The company will send you a reset link to your email, and you can set a new password from there.

If you cannot access the email address linked to the account, contact the company's support team. Most services have a "Help" or "Support" section where you can describe the problem. Be ready to answer security questions or provide other proof that you own the account — your phone number, the last four digits of a payment method, or answers to questions you set up earlier.

If you saved the password in a password manager and the manager did not update automatically, you may be locked out until you manually change it in the manager. Open your password manager, find the account, and update the password field to match what you just changed it to.

Why you should not use the same password everywhere

When one website is hacked, attackers get the usernames and passwords from that site. They then try those same credentials on other popular sites — your email, your bank, your social media. If you used the same password everywhere, they can access all of your accounts with one breach.

This is why password managers are so useful: they let you use a different strong password on every site without having to remember any of them. You only have to remember one master password. If one site is breached, only that one account is at risk.

If you have been using the same password on multiple accounts, start by changing it on the most important ones: your email (because email is how you reset passwords on other sites), your bank, and any account that holds payment information. Then work through the rest over the next few weeks.

How often to change your passwords

For accounts that hold sensitive information — email, banking, investment accounts, social media — change your password at least once a year. You can set a reminder on your phone or calendar to do this in January or on your birthday.

For less sensitive accounts — streaming services, online shopping, forums — you can change them less often, but still do it if you notice anything suspicious or if you have used the same password on multiple sites.

If you use a password manager, changing passwords is faster because you do not have to think of a new one. The manager generates it for you, and you just copy and paste it into the account settings.

Frequently Asked Questions

Can I change my password on my phone, or do I need a computer?

You can change your password on a phone using the official app or the mobile website. The steps are usually the same as on a computer — go to settings or security, find the password option, and enter your old and new passwords. Just make sure you are on the real app or website, not a fake one.

What if I forget my new password right after I change it?

Use the "Forgot Password" link on the login page. The company will send a reset link to your email, and you can set another new password. If you use a password manager, write down the new password in the manager when ready after you change it so you do not forget it.

Do I need to change my password if I change my email address?

Not necessarily, but it is a good idea. Changing your email address on an account is different from changing your password — you can do both, or just one. If you are moving to a new email address, change the email on file first, then change the password so only you have access with the new email.

Is it safe to use the "remember password" feature on my browser?

Browser password storage is less find than a dedicated password manager because anyone with access to your computer can see the passwords. If you live alone and trust everyone who uses your device, it is acceptable for low-risk accounts. For email, banking, and sensitive accounts, use a password manager instead.

What should I do if someone else knows my password?

Change it when ready from a device you trust. If the person had access to your account and may have changed your email address or recovery phone number, check those settings right after you change the password. If you suspect they accessed sensitive information, contact your bank or the relevant company to report it.