How to Create Strong Passwords and Use a Password Manager

Weak and reused passwords remain one of the most common ways accounts are compromised. The good news is that modern security advice is simpler than the old rules about symbols and monthly changes. Two habits make the biggest difference: use a different strong password for every important account, and let a password manager remember them for you.

Why password reuse is the real danger

When a website suffers a data breach, attackers obtain lists of email addresses and passwords. They then try those same combinations on other sites – email, banking, shopping, social media – using automated tools. This is called credential stuffing, and it works because so many people reuse passwords.

If every account has its own password, a breach at one site stays at one site.

What makes a password strong?

Old advice favoured short, complex passwords such as Tr0ub@dor3. They’re hard for people to remember and not especially hard for computers to guess. Current guidance from organisations such as the UK’s National Cyber Security Centre (NCSC) and the US National Institute of Standards and Technology (NIST) focuses on:

• Length – longer passwords are much harder to crack.
• Unpredictability – avoid names, dates, keyboard patterns (qwerty), common words with simple substitutions, and anything someone could find on your social media.
• Uniqueness – never reuse a password across accounts.

Use passphrases for passwords you must remember

The NCSC recommends combining three random words, for example coffee-trainer-planet (don’t use this example). Random words are memorable to you but hard to guess, especially if they are not related to each other or to you. You can add numbers or symbols if a website requires them.

Good candidates for passphrases are the few passwords you actually need to type: your computer login, your email account and your password manager’s master password.

Your most important password: email

Your email account is the key to everything else, because password reset links are sent there. Give it a strong, unique passphrase and turn on two-factor authentication. If an attacker controls your email, they can reset almost any other password you have.

How password managers work

A password manager is an app that stores your passwords in an encrypted “vault”. You unlock it with one master password (and ideally a second factor). It can then:

• generate long, random passwords for each site;
• fill them in automatically in your browser and apps;
• sync across your phone and computer;
• warn you about reused, weak or breached passwords.

Options include the managers built into browsers and operating systems (such as those from Google, Apple and Microsoft) and standalone apps from dedicated security companies. Built-in managers are convenient and a big improvement over reuse; standalone managers typically work across more browsers and platforms and offer extra features like secure sharing. Choose a well-established provider and download it only from the official website or app store.

Getting started with a password manager

1. Choose a manager that works on all the devices you use.
2. Create a strong master password – a passphrase of several random words that you don’t use anywhere else. Write it down and store it somewhere physically safe at first if you’re worried about forgetting it.
3. Turn on two-step verification for the password manager account.
4. Save the recovery information the manager provides (such as a recovery code or emergency kit) somewhere safe.
5. Add your most important accounts first: email, banking, Microsoft or Google account, social media and shopping sites with saved cards.
6. Change reused passwords as you go, using the generator.
7. Over the following weeks, save new logins as you use them.

You don’t need to update everything in one day. Prioritise accounts that hold money, personal data or access to other accounts.

Check whether your details have been breached

Many password managers and browsers alert you when a saved password appears in a known breach. You can also check your email address on reputable breach-notification services. If an account appears in a breach, change that password and any others where you used the same one.

What about passkeys?

Passkeys are a newer way to sign in without a password at all. They use cryptographic keys stored on your device or in your password manager, unlocked with your fingerprint, face or device PIN. Because there’s no password to steal or type into a fake site, passkeys are highly resistant to phishing. Where a service offers passkeys, they’re worth turning on.

Other good habits

• Never share passwords by email or text message.
• Don’t enter passwords on sites you reached from a link in an unexpected message – see how to recognise phishing.
• Lock your devices with a PIN, password or biometrics.
• Be wary of browser extensions and apps from unknown developers that request access to your passwords.

Conclusion

You don’t need to memorise dozens of complex passwords. Use a few strong passphrases for the accounts you type into, especially email and your password manager, and let the manager generate unique passwords for everything else. Add two-factor authentication and passkeys where available, and you’ll have closed the door on the most common account attacks.