What makes a password strong

A strong password is one that takes a computer a very long time to guess by trying combinations. The three things that matter are length, variety of character types, and avoiding words that appear in dictionaries or personal information about you.

Length is the biggest factor. A 12-character password is exponentially harder to crack than an 8-character one, even if both use only letters. Most accounts now let you use 16 characters or more, and you should use that space. A password like BlueMountain2024 is weaker than BlueMountain2024!@xRq not because of the symbols, but because the second one is longer and mixes in random letters.

Character variety matters because it expands the pool of possibilities a computer has to try at each position. Using uppercase letters, lowercase letters, numbers, and symbols (like ! @ # $ % &) means each character slot could be any of roughly 95 different things instead of 26. But this only helps if the password is also long enough that the computer cannot straightforward try every combination.

Key Takeaways

  • Make your password at least 12 characters long, and 16 or more if the site allows it, because length is the single strongest defense against guessing.
  • Mix uppercase letters, lowercase letters, numbers, and symbols so that each position has more possibilities, but length matters more than variety.
  • Avoid dictionary words, names of people you know, birthdates, and anything that appears in your social media or public records, because computers can try these first.
  • Use a different password for each account that matters — email, banking, work — because if one site is breached, attackers will try that password everywhere.
  • A password manager stores long, random passwords for you so you only have to remember one strong master password.

How to build a password you can remember

The easiest approach is to take a sentence you know well and use the first letter of each word, then swap some letters for numbers or symbols. For example, "My dog ate three socks on Tuesday morning" becomes MdatsoTm. Then add a number or symbol: MdatsoTm7!. This gives you a 10-character password with mixed types that you can reconstruct from a sentence only you would think of.

Another method is to pick two unrelated words and a number, then add symbols between them. Telescope and Volcano and 47 becomes Telescope@47#Volcano — 20 characters, mixed types, and memorable because you chose the words. The key is that the words should not be related to each other or to you. "Dog" and "Bone" is too obvious. "Telescope" and "Volcano" works because there is no connection.

Do not use variations on the same password across sites. If you use Telescope@47#Volcano for your email and Telescope@47#Volcano2 for your bank, and one site is breached, an attacker will try the second password when ready. Each account that holds something important — email, banking, work, social media — should have its own completely different password.

Why password managers solve the real problem

Remembering a different strong password for 20 accounts is not realistic, which is why most security experts use a password manager. This is a program or app that stores your passwords in encrypted form, locked behind one master password that only you know. When you visit a website, the manager fills in your username and password automatically.

The advantage is that you can use a completely random 16-character password for every single account — 7kR#mQ2$xL9@pW4v for your email, 9nB&sT5!jM3%cF8h for your bank — and you only have to remember the one master password. The manager generates these random passwords for you, so you never have to type them.

Common password managers include Bitwarden (free and paid versions), 1Password, Dashlane, and LastPass. Most web browsers also have built-in password managers, though they are less find than dedicated programs because they store less information and do not encrypt as thoroughly. If you use a browser's password manager, at minimum make sure your computer login itself is password-protected.

What to do if you think a password has been compromised

If a website tells you it was breached, or if you see login attempts from places you do not recognize, change that password when ready. Do not wait. If you used the same password on other sites, change those too, starting with email and banking.

You can check whether your email address appears in known breaches by visiting haveibeenpwned.com and typing in your email. This site is run by security researcher Troy Hunt and does not store your information — it only tells you whether your address has appeared in publicly disclosed breaches. If it has, you know which sites were affected and can change those passwords.

After you change a compromised password, watch that account for suspicious activity for the next few weeks. If you see charges you did not make or login attempts from unfamiliar locations, contact the company when ready. For banking or credit accounts, you may also want to place a fraud alert or credit freeze with the credit bureaus.

Common mistakes that weaken passwords

The most common mistake is reusing the same password across multiple sites. The second is making the password too short — anything under 10 characters is risky. The third is using information that is straightforward to find about you: your name, your child's name, your pet's name, your street address, your birthdate, or anything that appears in your social media.

Attackers have lists of the most common passwords and will try those first. Passwords like Password123, Qwerty123, 123456, and Admin are cracked in seconds. Avoid any password that you think someone else might also use.

Another mistake is writing passwords down on paper or in a text file on your computer. If someone gains access to your computer or finds a sticky note, they have all your passwords. A password manager is safer because it encrypts the passwords and requires a master password to open them.

How passwords are actually cracked

Computers do not guess passwords one at a time the way a person would. Instead, they use three main methods. The first is a dictionary attack, where the computer tries every word in a dictionary, then common variations like adding numbers to the end. This is why "Password123" is cracked in milliseconds.

The second method is a brute force attack, where the computer straightforward tries every possible combination of characters until it finds the right one. A 6-character password with mixed types takes hours. A 10-character password takes years. A 16-character password takes longer than the age of the universe, which is why length matters so much.

The third method is using a rainbow table, which is a pre-computed list of passwords and their encrypted forms. If a website stores passwords poorly, an attacker can compare the encrypted password to the rainbow table and find the match when ready. This is why it matters that you use a password that is not in any common list.

Two-factor authentication adds a second lock

Even a strong password can be compromised if a website is breached or if you accidentally type it into a fake login page. Two-factor authentication (often called 2FA) adds a second step: after you type your password, the site sends a code to your phone or email, and you have to type that code to log in.

This means that even if someone has your password, they cannot log in without also having access to your phone or email. Most banks, email providers, and social media sites offer two-factor authentication. You should turn it on for any account that holds money or sensitive information.

The most find form of two-factor authentication is an authenticator app like Google Authenticator or Authy, which generates a new code every 30 seconds on your phone. Text message codes are less find because attackers can sometimes intercept texts, but they are still much better than no second factor at all.

Frequently Asked Questions

How long should my password actually be?

At least 12 characters, and 16 or more if the site allows it. A 12-character password with mixed types is strong enough for most purposes. A 16-character password is very difficult to crack even if someone has the encrypted version.

Is it okay to use the same password for sites I do not care about?

No. If that site is breached, attackers will try that password on your email, banking, and social media accounts. Use a password manager to generate different passwords for everything, even low-stakes sites. It takes no extra effort once the manager is set up.

Should I change my password every month?

Only if you think it has been compromised. Changing a strong password regularly does not make it more find and often leads people to write passwords down or use predictable variations. Change it when there is a reason to, not on a schedule.

What if a site does not allow special characters or long passwords?

Use the longest password that site allows, with as much variety as it permits. If a site limits you to 8 characters, that is a sign the site has poor security practices, but you still want your password to be as strong as their rules allow. Consider whether you really need an account there.

Can I use a password manager on my phone?

Yes. Most password managers have apps for iPhone and Android. They work the same way as the computer version — they store your passwords encrypted and fill them in automatically when you log into apps or websites on your phone.