Passwords protect some of the most important parts of our digital lives. Your email, social media, shopping accounts, cloud storage and other services may all depend on them.
A weak password can make an account easier to guess or take over. Reusing the same password can be even more dangerous because one exposed password may give an attacker a way into several accounts.
The good news is that stronger passwords do not require complicated tricks. The most useful ideas are simple: make passwords long, make every important password unique, and avoid anything that another person or a guessing program could easily predict.
What actually makes a password strong?
A strong password is not simply one that looks complicated.
A short word with a capital letter, number and symbol may look impressive, but attackers know that people often follow predictable patterns. Length, uniqueness and unpredictability matter much more than following a familiar visual recipe.
1. Make it long
Length is one of the most important characteristics of password strength.
Current NIST guidance for covered services sets a minimum of 15 characters when a password is used as a single authentication factor. CISA gives consumers an easy practical target of 16 or more characters.
For everyday use, a simple HubEgg rule is:
Aim for at least 16 characters where the service allows it.
Longer passwords create more possible combinations for an attacker to test. This makes password guessing more difficult, especially when the password is also unpredictable.
You do not need to make a password difficult for yourself simply to make it look complicated. A long password can often be both stronger and easier to manage than a short password built around complicated character rules.
2. Use a different password for every important account
Password reuse is one of the biggest weaknesses in everyday account security.
Imagine that you use the same password for your email, a shopping website and a social network. If one of those services suffers a breach and your password is exposed, criminals can try the same email address and password on other websites.
Automated tools can perform these attempts very quickly.
A strong password therefore needs to be unique, not merely long.
Your email account deserves particular care because email is often used to reset passwords for other services.
One account, one password.
If one password is exposed, using unique passwords helps limit the damage to a single account.
3. Make it difficult to predict
Avoid building passwords from information that another person could discover or guess.
Examples include your name, birthday, phone number, pet name, favourite team, school, workplace or other personal details.
Changing predictable information slightly does not necessarily make it unpredictable. Adding a number or symbol to a familiar word can still produce a pattern that password guessing tools know how to test.
Randomness is more useful than clever looking substitutions.
What is a passphrase?
A passphrase is simply a password made from several words.
The words should not form a famous quotation, song lyric, movie line or common expression. Those phrases may already appear in password guessing lists.
Instead, choose unrelated words.
For example, imagine a phrase such as:
harbor tulip comet velvet mango
This is only an illustration. Do not use that exact phrase as your password.
The important idea is that unrelated words can create something long without making it impossible for a person to remember.
Different security authorities describe slightly different approaches. The NCSC teaches a three random words method, while other guidance focuses primarily on total length. There is no single magic number of words that makes every passphrase safe.
The shared idea is more useful:
Use enough unrelated words to create a long and unpredictable passphrase.
Password or passphrase: which should you use?
Both can work well.
A password manager can create a long random password that you do not need to memorize. This is often an excellent choice for ordinary website accounts.
A passphrase can be useful for the smaller number of passwords that you genuinely need to remember, such as the main password that unlocks a password manager.
The important thing is not whether you call it a password or a passphrase. What matters is that it is long, unique and difficult to predict.
Do you really need uppercase letters, numbers and symbols?
Symbols, numbers and capital letters can be part of a strong password, but forcing people to follow a fixed recipe does not automatically produce strong passwords.
People often respond to strict complexity rules in predictable ways. They may capitalize the first letter, add a number at the end and finish with a common symbol.
Attackers understand these patterns.
Current NIST guidance therefore tells password systems not to impose composition rules that require specific mixtures of character types.
This does not mean symbols are bad. It means that length, uniqueness and unpredictability matter more than simply satisfying a familiar recipe.
If a website requires certain characters, follow its requirements. Just do not assume that meeting those requirements automatically makes a password strong.
Why password reuse is especially dangerous
Suppose a small website you used several years ago is compromised.
You may no longer care much about that account. But if its password is the same password you currently use for your email, that old account suddenly matters a great deal.
Criminals can take credentials exposed by one service and try them on other services.
Using a unique password limits the damage. A compromised password then affects one account rather than becoming a key to several accounts.
This is one of the strongest reasons to use a password manager.
How a password manager helps
Remembering dozens of long and unique passwords is difficult. You should not have to memorize all of them.
A password manager can generate random passwords, store them securely and fill them in when you return to a website or app.
That makes it practical to use a different password for every account.
You still need to protect the password manager itself carefully. Use a strong main password or passphrase and enable additional account protection where available.
Should you change your password every few months?
Not simply because a certain number of days has passed.
Older advice often required people to replace passwords every 30, 60 or 90 days. Current NIST guidance does not recommend arbitrary periodic password changes.
Frequent forced changes can encourage predictable behaviour, such as changing only the number at the end of a password.
Instead, change a password when there is a reason.
- You receive reliable notice that the password was exposed.
- You discover suspicious activity on the account.
- You realize that you reused the password elsewhere.
- Someone else knows the password.
- A service tells you that a password change is required because of a security incident.
When you replace a compromised password, create a genuinely new one.
A strong password cannot stop every attack
Even an extremely strong password can be stolen.
A convincing phishing page can trick someone into typing a password directly into a fake login form. Malware may also capture credentials.
NIST explicitly notes that passwords themselves are not resistant to phishing.
This is why passwords should be one part of your account protection rather than the only part.
Turn on multi factor authentication where it is available. Consider stronger sign in methods such as passkeys when a trusted service supports them.
A strong password makes guessing harder, but good online security uses several layers.
Quick password safety checklist
- Use a different password for every important account.
- Aim for at least 16 characters where possible.
- Avoid names, birthdays and predictable personal information.
- Use unrelated words if you create a passphrase.
- Use a password manager when it makes sense.
- Protect your email account especially carefully.
- Use multi factor authentication where available.
- Change a password when there is evidence that it may be compromised.
You do not need to fix every account at once. Start with your email account, then payment services, cloud storage, social media and other accounts that contain important information.
What to learn next
This article expands the password guidance in Complete Guide to Staying Safe Online.
A future HubEgg lesson will turn these ideas into a practical exercise for creating and evaluating a memorable passphrase.