Passwords protect email, banking, social media and more, yet many people still use short or reused ones. Security agencies now give clear advice: make passwords long, make each one unique and add a second layer of protection where you can.
Key takeaways
- Length matters more than clever symbols.
- Use a different password for every account.
- A passphrase made of several random words is easy to remember and hard to guess.
- Turn on multi-factor authentication for important accounts.
- A password manager makes unique passwords practical.
What makes a password weak
Attackers use automated tools that try common passwords, leaked passwords and simple variations. Weak choices include:
- Common passwords such as "123456" or "password."
- Names, birthdays, pet names or other personal details that are easy to find.
- Keyboard patterns such as "qwerty."
- Simple substitutions, such as "P@ssw0rd," which attackers know about.
- A familiar word followed by a number.
- The same password used on several sites.
Make it long
Each extra character multiplies the number of guesses needed. National cyber security agencies generally recommend long passwords, with at least 12 to 16 characters for important accounts. The old advice to include a mix of uppercase, lowercase, numbers and symbols is less important than length, though some sites still require it.
Use a passphrase
A passphrase is a string of several unrelated words, such as "copper-lantern-river-quiet-seven." It is long, easy to type and easier to remember than a jumble of symbols. For best results, choose words randomly, for example using dice or a generator, and not a famous quote or a phrase from a song. Four to six random words is a common recommendation.
Never reuse passwords
When one website is breached, attackers try the leaked email and password on other sites. If you reuse a password, one breach can open many doors. Use a unique password for each account, starting with the most important ones: email, banking, cloud storage and your phone's account. Email is especially critical because it is often used to reset other passwords.
Add a second factor
Multi-factor authentication, MFA, requires something more than a password, such as a code from an authenticator app, a text message code, a fingerprint or a physical security key. Even if someone steals your password, they cannot easily log in. Authenticator apps and security keys are generally stronger than text messages. Turn it on for email, financial and social accounts.
Use a password manager
Remembering dozens of long, unique passwords is unrealistic. A password manager creates and stores them securely, protected by one strong master password. Browsers and phones also have built-in managers. Choose a reputable one and protect it with MFA.
Watch out for scams
Phishing messages try to trick you into entering your password on a fake website. Be cautious about links in emails or texts, and go to sites directly instead. Never share your password or one-time codes with anyone who contacts you. Real organisations will not ask for them.
Changing passwords
Modern guidance says you do not need to change passwords regularly if they are strong and have not been compromised. Change them promptly if a service reports a breach or if you suspect someone has accessed your account. Websites such as Have I Been Pwned let you check whether your email appears in known breaches.
How attackers guess passwords
Attackers use several methods. In a brute-force attack, software tries every possible combination, which becomes impractical as passwords grow longer. In a dictionary attack, it tries common words, names and passwords leaked in earlier breaches, plus predictable variations such as adding a number at the end. Credential stuffing takes email and password pairs leaked from one site and tries them on others. Phishing tricks people into typing their password into a fake site. Strong, unique passwords defeat the first three, and multi-factor authentication helps against phishing.
The mathematics of passphrases
Strength is often measured in bits of entropy, where each extra bit doubles the number of guesses needed. A random word chosen from a list of 7,776 words, as in the Diceware method, adds roughly 12.9 bits. A passphrase of six random words therefore has about 77 bits, which is very hard to guess, while being easier to remember than a random string. The key word is random: words picked by you, or a quotation from a book or song, are far less secure because attackers try those first. Use a generator or dice to choose words.
Ranking second factors
Not all second factors are equally strong. Security keys and passkeys, which use cryptographic proof tied to the real website, resist phishing and are among the strongest options. Authenticator apps that generate one-time codes are a good choice, though a convincing fake website can still trick a user into entering a code. Codes sent by text message are better than nothing, but they can be intercepted through techniques such as SIM swapping. Wherever you can, choose the strongest option offered and keep backup codes in a safe place.
Recovery details
Account recovery can be the weak link. Make sure your recovery email address and phone number are up to date and are themselves well protected, because attackers who take over your email can reset many other accounts. Save the backup codes the service gives you, and store them offline. Be careful with security questions, since answers such as a mother's maiden name or first pet can often be found online. Consider using random answers stored in a password manager.
What to do after a breach
If a service you use reports a breach, change that password immediately, and change any other account where you used the same one. Check whether your email appears in known breaches using a reputable service such as Have I Been Pwned. Turn on multi-factor authentication, watch your accounts for unusual activity, and be alert to phishing messages that use leaked details. If financial information was exposed, contact your bank, and consider a credit freeze or fraud alert where available.
Frequently asked questions
Is it safe to write passwords down?
A paper list kept in a secure place at home is safer than reusing weak passwords, but a password manager is a better solution for most people.
How long should a passphrase be?
Four to six random words is a good start for important accounts.
Are security questions safe?
Answers are often easy to find or guess. Consider using random answers stored in your password manager.
Are passphrases with spaces acceptable?
Most modern systems allow spaces, but some do not, so hyphens or no separator are common alternatives. What matters is that the words are random and the passphrase is long.
Is it safe to use my browser's suggested password?
Yes, generated passwords are long and random, and browsers store them in an encrypted form. Protect the browser account or device with a strong login and multi-factor authentication, since it unlocks all your saved passwords.
How can I remember many passwords?
You do not need to. Use a password manager to remember the unique password for each site, and memorise just the master password and a few critical ones such as your email and device unlock code.
Sources and further reading
Written by
FactNest Editorial Team
FactNest is operated by Muonix. The FactNest Editorial Team publishes general-interest explainers with AI-assisted drafting and illustrations. Contact contact@muonix.co for questions or corrections; we respond within 2 business days.
More from this author →
