Create Strong Passwords (and Remember Them!)
Think about how many things you do online every day. You check your email, manage your finances, shop, stream your favourite shows, and log in to work accounts. Each of these activities relies on one important thing: your password.
Passwords remain one of the first lines of defence against cybercriminals. That’s why creating and managing strong passwords is such an important everyday cybersecurity habit. In fact, it’s the first of our Core 4 cybersecurity behaviours!
The good news? Protecting your accounts doesn’t have to be complicated or stressful. With tools like password managers and newer options such as passkeys, it’s easier than ever to stay secure without remembering dozens of complicated passwords.
Let’s look at what makes a password strong, how to protect your accounts, and how to make password management easier.
The three golden rules of strong passwords
When creating a strong password, keep three things in mind: length, uniqueness, and randomness.
Get these three things right, and you’ll make it much harder for cybercriminals to access your accounts.
1. Make your passwords long
When it comes to passwords, longer really is better.
Aim for at least 16 characters for every password. The longer a password is, the harder it is for attackers to guess using automated tools.
Even passwords that look complicated can be vulnerable if they’re too short. Adding more characters can significantly increase how long it takes someone to crack a password.
But let’s be honest: remembering a different 16-character password for every account sounds like a nightmare!
That’s where password managers come in. They can generate and securely store long passwords, so you don’t have to memorise them all.
2. Use a different password for every account
Here’s a rule worth remembering: never reuse passwords. Every account should have its own unique password.
It’s tempting to use the same password for several accounts, especially when you have so many logins to track. If you’ve done this, you’re certainly not alone.
However, password reuse creates a serious security risk. If cybercriminals compromise one account, they may try the stolen password on your other accounts. Automated tools make this process quick and easy.
That means a breach involving one account could potentially put your email, online banking, social media, and other accounts at risk.
And simply changing one or two characters doesn’t solve the problem. Adding a number, symbol, or extra letter to an existing password isn’t enough to make it meaningfully unique.
The best approach? Use a completely different password for every account. Once again, a password manager makes this much easier.
3. Keep passwords random and unpredictable
A strong password shouldn’t be something another person could easily guess.
Avoid using familiar words, names, birthdays, anniversaries, or predictable keyboard patterns. Even seemingly clever substitutions, such as replacing an ‘a’ with ‘@’, aren’t as secure as they might appear.
Instead, use a random mix of letters, numbers, and symbols. The goal is to create something that has no obvious connection to you or your personal information.
Some websites also allow spaces in passwords, which can give you another way to create longer combinations.
Remember, length and randomness work together. A long, unpredictable password is much stronger than a short password that looks complicated.
Fortunately, most password managers can generate random passwords automatically, taking the guesswork out of creating secure logins.
What does a strong password look like?
Let’s bring those three rules together.
A strong password should be:
- At least 16 characters long.
- Unique to the account – never reused elsewhere.
- Random and unpredictable, using a combination of letters, numbers, and symbols where supported.
Here are a few examples of what a randomly generated strong password might look like:
VYffnxK9O$VuL59k8&QpP3SdsPzUf5P62kwe-85o5-LPFYz8
Important: These are examples only! Don’t use them for your actual accounts. Always generate your own unique passwords.
Add another layer of protection with multifactor authentication (MFA)
Even the strongest password can be stolen, so add another layer of security wherever possible.
That’s where multifactor authentication (MFA) comes in.
MFA adds an extra verification step when you sign in to an account. Depending on the service, this could be:
- A code generated by an authentication app.
- A verification code sent to your phone.
- A fingerprint scan.
- Facial recognition.
- A security key or another trusted device.
The idea is simple: even if someone steals your password, they’ll still need to pass that extra verification step to access your account.
Make it a habit to enable MFA wherever it’s available, especially for email, banking, social media, and work-related accounts.
It might take a few extra seconds to log in, but that small inconvenience is well worth the added protection.
And one important reminder: never share your MFA verification codes with anyone. A legitimate support representative should never ask you to hand over a login code.
How often should you change your passwords?
You may have heard that you should change passwords every 30, 60, or 90 days. That’s advice many of us grew up with, but security guidance has moved on.
If your passwords are already long, unique, and random, there’s generally no need to change them on a regular schedule.
In fact, forcing people to change passwords too frequently can encourage poor habits, such as reusing old passwords or choosing simpler combinations that are easier to remember.
Modern guidance, including recommendations from the National Institute of Standards and Technology (NIST), supports changing passwords when there’s a reason to do so rather than simply because a certain amount of time has passed.
You should change your password if:
- You suspect someone else has accessed your account.
- You receive a notification that your account was involved in a data breach.
- You’ve accidentally shared your password with someone.
- You’ve reused the password on a compromised account.
The takeaway? Create strong passwords from the start, and change them promptly if you have any reason to believe they’re no longer secure.
Why a password manager makes life so much easier
Let’s face it: most of us have far too many online accounts to remember every password.
Trying to create, memorise, and keep track of hundreds of long, unique passwords isn’t realistic. And that’s exactly why password managers are so useful.
A password manager is an app or tool that securely stores your passwords in an encrypted digital vault. You only need to remember one strong master password to access it, and the manager handles the rest.
The benefits of using a password manager
A good password manager can:
- Generate strong passwords: Create long, random passwords for every account.
- Remember them for you: No more trying to memorise dozens of complicated combinations.
- Fill in login details automatically: Save time when signing in to websites and apps.
- Store new passwords securely: Keep your credentials organised in one protected place.
- Reduce password reuse: Make it easy to use a different password for every account.
Many modern password managers use strong encryption and a zero-knowledge design. This means your passwords are encrypted so the provider can’t view your stored credentials.
For an additional layer of protection, always enable MFA on your password manager account, too.
Password managers really are a game-changer
Think about how many accounts you use. Email, shopping, banking, social media, subscriptions, work platforms – the list goes on.
Reusing passwords across these accounts creates a potential single point of failure. One compromised password could put several other accounts at risk.
A password manager reduces the hassle by making it easy to create and use unique passwords.
Many options are free or relatively inexpensive, and most work across your phone, tablet, and computer.
Once you get into the habit, managing your passwords often becomes easier, not harder!
Still prefer keeping your passwords in a physical notebook? We understand. Just make sure you’re following the three golden rules and treat that notebook like cash. Keep it somewhere secure, don’t leave it lying around on your desk or in your car, and never take unnecessary risks with it.
What about passkeys?
You may have started noticing another login option appearing on websites and apps: passkeys.
Passkeys are a newer, more secure alternative to traditional passwords. On supported services, they let you sign in without typing a password.
Instead, you authenticate using a trusted device, often with a fingerprint, facial recognition, or your device’s PIN.
Why are passkeys worth considering?
- They’re designed to resist phishing attacks.
- You don’t need to remember or type a password.
- Signing in is usually quick and straightforward.
- They can be securely stored and managed by many modern password managers.
If a website or app lets you create a passkey, it’s worth considering. They’re generally easy to set up and can make signing in both safer and more convenient.
That said, passwords aren’t disappearing just yet. Many services still rely on traditional passwords, so it’s important to keep practising good password habits. The good news is that many password managers can now store and manage passkeys alongside your existing passwords.
Make strong passwords part of your everyday routine
Good password habits don’t have to take up much time or effort. A few simple changes can make a big difference to your online security.
Let’s recap the essentials:
- Go long: Aim for at least 16 characters.
- Keep them unique: Never reuse the same password across accounts.
- Make them random: Avoid predictable words, names, and personal details.
- Enable MFA: Add another layer of protection wherever possible.
- Use a password manager: Let technology remember your passwords.
- Try passkeys: Use password-free sign-ins when they’re available.
Remember, cybersecurity isn’t about making your digital life difficult. It’s about building small, sensible habits that help keep you, your information, and your accounts safe.
Start with one account, create a stronger password, and consider setting up a password manager. Before long, you’ll have taken an important step towards making your online life more secure.
Strong passwords are one of the simplest ways to protect yourself online – and with the right tools, they’re easier to manage than you might think!