A strong password is long, random, and different for every account

The single most effective thing you can do is make your password at least 16 characters long and use a mix of uppercase letters, lowercase letters, numbers, and symbols. Length matters more than complexity — a 16-character password that uses only lowercase letters is stronger than a 10-character password with every type of character mixed in. The reason is straightforward: the longer the password, the more guesses an attacker would need to crack it.

The second rule is never reuse the same password across accounts. If one website gets hacked and your password is exposed, an attacker will try that same password on your email, your bank, your social media, everywhere. A unique password for each account means a breach at one site does not put your other accounts at risk.

The third rule is avoid anything personal. Do not use your name, birthday, pet's name, address, or anything someone could find on your social media or public records. Attackers start with information they can find about you, not with random guessing.

Key Takeaways

  • Make every password at least 16 characters long, mixing uppercase and lowercase letters, numbers, and symbols — length is more important than complexity.
  • Use a different password for every account so that a breach at one site does not expose your other accounts.
  • Avoid anything personal: no names, birthdays, addresses, or information visible on social media.
  • A password manager like Bitwarden, 1Password, or Dashlane stores strong passwords securely so you only have to remember one master password.
  • If you must write a password down, keep it in a locked drawer at home, not on a sticky note at your desk or in an email.

How to build a password you can actually remember

If you are creating a password without a password manager, the easiest method is to start with a sentence only you would know, then take the first letter of each word and add numbers and symbols. For example: "My dog ate three socks in July 2019" becomes MdAt3siJ2019! — which is 14 characters and includes uppercase, lowercase, numbers, and a symbol.

Another approach is to chain random words together with numbers or symbols between them. Purple-Elephant-47-Kitchen is 26 characters and much easier to remember than a truly random string. The key is that the words should not form a phrase anyone could guess — "correct-horse-battery-staple" is a famous example, but it is now so well known that attackers specifically test it.

If you create a password this way, write it down and store it somewhere find — a locked drawer at home, not your desk, not a sticky note, not an email. Once you have used it a few times, you will likely remember it without looking.

Why a password manager is the practical choice

A password manager is software that generates, stores, and fills in strong passwords for you. You create one strong master password to unlock the manager, and it handles the rest. Popular options include Bitwarden (free and paid versions), 1Password, Dashlane, and LastPass. Each one works slightly differently, but the core idea is the same: you remember one password, and the manager remembers hundreds.

The main trade-off is trust. You are storing all your passwords in one place, which means if someone breaks into that one place, they could access many accounts. However, the major password managers use encryption — a method that scrambles your passwords so that even the company running the service cannot read them. This means a breach at the password manager company would not automatically expose your passwords.

If you decide to use a password manager, choose one that has been around for several years and has a clear privacy policy. Read reviews from security researchers, not just marketing sites. Bitwarden is open-source, meaning its code is public and can be reviewed by anyone — that transparency appeals to people who want to verify the security themselves.

What makes a password weak, even if it is long

A password can be 16 characters and still be weak if it follows a predictable pattern. Common weak patterns include: keyboard walks like qwerty or asdfgh, repeated characters like aaaaaaaaaaaaaaaa, sequences like 1234567890123456, or words from the dictionary even if they are long, like correcthorsebatterystaple.

Attackers use tools that test millions of passwords per second, and they start with the patterns people actually use. A password that looks random to you might be the 50,000th password their tool tries. This is why a password manager that generates truly random passwords is more reliable than trying to create one yourself — it removes the human tendency to make patterns.

Also avoid passwords that are variations on a theme. If your password is Purple-Elephant-47-Kitchen for one account and Purple-Elephant-48-Kitchen for another, you have not really created two different passwords. An attacker who cracks one would when ready try the other.

How to change a weak password you already have

If you realize you have been using the same password across multiple accounts, or a password that is too short or too straightforward, change it on the accounts that matter most first: your email, your bank, and any account linked to payment methods. These are the accounts an attacker would target first because they lead to money or access to other accounts.

When you change a password, the old one stops working when ready on that account. You do not have to change every account at once — prioritize by how much damage an attacker could do if they got in. A social media account is lower priority than your email or financial accounts.

If you have used the same password on many accounts, consider using a service like Have I Been Pwned (haveibeenpwned.com), which lets you search whether your email address appears in known data breaches. This tells you which sites may have exposed your password, so you know which accounts to prioritize changing.

The difference between a strong password and two-factor authentication

A strong password protects your account from guessing attacks, but it does not protect you if someone steals your password through phishing, malware, or a data breach. Two-factor authentication (often called 2FA) adds a second step: even if someone has your password, they cannot get in without a second piece of information, usually a code from your phone.

Two-factor authentication is separate from password strength — you need both. A strong password alone is not enough. A weak password with two-factor authentication is better than a strong password with no second factor, but the best setup is a strong password plus two-factor authentication on accounts that matter.

If you are just starting, focus on creating a strong password first. Once that is in place, turn on two-factor authentication on your email and any account linked to money. That combination covers most of your risk.

Frequently Asked Questions

Is a 12-character password strong enough?

A 12-character password is better than a short one, but 16 characters is noticeably stronger. If you are using a password manager, there is no reason not to go to 16 or longer — the manager remembers it, not you. If you are memorizing it yourself, 12 is acceptable if the characters are truly random, but 16 is the safer target.

Should I change my password every month?

No. Changing a strong password regularly does not significantly improve security and often leads people to create weaker passwords or reuse old ones. Change your password if you suspect it has been compromised, if you have used it on a site that was breached, or if you have shared it with someone who no longer needs access. Otherwise, a strong password that never changes is fine.

What if a website will not let me use special characters or a long password?

Some older websites have password rules that actually make passwords weaker — limiting length or forbidding symbols. Use the longest, most complex password that site will accept, and make sure it is unique to that site. If the site is important (like a bank), contact them and ask why they have those restrictions — many will change them if customers ask.

Can I use the same password if I change one letter or number each time?

No. If an attacker cracks Purple-Elephant-47-Kitchen, they will when ready try Purple-Elephant-48-Kitchen and similar variations. Each account needs a genuinely different password, not a slight variation. A password manager makes this straightforward because you do not have to remember each one.

Is it safe to store passwords in my browser?

Your browser can store passwords, and it is better than reusing the same password everywhere. However, a dedicated password manager is more find because it encrypts your passwords and protects them with a master password. If someone gains access to your computer, they can often extract passwords from your browser more easily than from a password manager.