What makes a password strong
A password protects an account by being hard for someone else to guess. Attackers rarely sit and type guesses by hand. They use software that tries enormous numbers of possibilities, starting with the most common ones: words, names, dates, keyboard patterns such as “qwerty”, and slight variations like replacing “a” with “@”. A password built from these is guessed quickly.
Two qualities matter most.
Length. Each extra character multiplies the number of combinations an attacker must try. Security agencies generally encourage long passwords, and many now recommend passphrases of several unrelated words. Exact recommended lengths vary between organizations, so treat a longer password as better, and check any minimum your service sets.
Unpredictability. A password is only as hard to guess as the method used to create it. A phrase of several random words, for example, is usually stronger than a short password with a capital letter, a number and a symbol added in predictable places. A line from a song or a phrase connected with you, such as a pet’s name plus a birth year, is easier to guess than it feels.
Complexity rules such as “must contain a symbol” can push people into predictable patterns, such as capitalizing the first letter and adding “1!” at the end. That is why length and randomness tend to matter more than decoration.
Why every password should be unique
Data breaches are common. When a website is hacked, lists of email addresses and passwords can be leaked or sold. Attackers then try those same pairs on other services, a technique often called credential stuffing. If you have reused a password, one breach on a minor site could open your email, your learning accounts and more.
Email deserves particular care. Most services let you reset a password through your email, so whoever controls your inbox may be able to take over many other accounts. Give your email a password that you use nowhere else, and protect it with two-factor authentication.
The problem with memory
A unique, long, random password for each of dozens of accounts is more than anyone can remember. People cope by reusing passwords, making small changes to one base password, or writing them in an unprotected note. Each of these weakens security. This is the problem a password manager solves.
What a password manager does
A password manager is a program or service that stores your logins in an encrypted vault. You unlock it with one strong master password, and sometimes with fingerprint or face recognition on your device. Typical features include:
- Generating long, random passwords for new accounts.
- Filling in logins automatically, on sites whose address matches the saved one.
- Keeping all your passwords synchronized across your devices, if you choose that option.
- Flagging passwords that are reused, weak, or found in known breaches.
- Storing other sensitive notes, such as recovery codes.
Because the manager fills in credentials only on the correct address, it can also act as a warning against fake sites. If it does not offer to fill in your login on a page that claims to be your bank or course provider, take a moment to check the address, because the page may be a phishing attempt.
Browsers and operating systems have built-in managers, and there are separate standalone ones too. Their features, security and costs vary, so choose one from a reputable source, read what the provider says about how it protects your data, and ask your institution if it recommends one.
Risks and how to manage them
Putting all your passwords in one place can feel risky, and it is fair to ask what happens if the vault is compromised. Vaults are normally encrypted so the provider cannot read them, and for most people a manager is considered safer than reusing passwords. But a few cautions apply:
- The master password is critical. Make it long, unique and memorable to you, such as a passphrase of several random words. Never reuse it, and do not store it in the vault itself.
- Recovery can be hard. Many managers cannot recover your master password if you forget it. Read the recovery options when you set up, and keep any recovery kit in a safe place offline.
- Protect the manager account. Turn on two-factor authentication for it.
- Lock it when you leave. On shared or public computers, avoid saving or syncing a vault, and lock or log out afterwards.
- Keep devices secure. A manager cannot protect against malware on a compromised device, so keep software updates current.
Getting started without being overwhelmed
Changing every password at once is unrealistic. A sensible order is:
- Choose a manager and set a strong master password.
- Change the password on your main email account.
- Update banking, shopping and learning accounts, plus any you know were involved in a breach.
- Let the manager fill the rest in over time as you log in.
If you do not want to use a manager, a notebook kept somewhere secure at home can be a reasonable fallback for non-technical users, as the main threat to most people is online attack rather than a burglar. Never keep passwords in a text file on your desktop or on a note stuck to a device you carry around.
Habits worth avoiding
- Sharing passwords by email or chat.
- Using personal details such as names, birthdays or addresses.
- Reusing a password because a site seems unimportant.
- Changing passwords on a fixed schedule without a reason. Current guidance from several national agencies is to change a password when there is evidence of a compromise, rather than on a routine timetable, though your school or employer may still impose its own rules.
No password scheme gives complete protection. Combined with a second login step and careful attention to fake messages, though, long unique passwords make the usual attacks much harder. For advice specific to your situation, check the guidance published by your country’s cyber security agency.