Strong passwords: a practical guide

Most hacked accounts begin with a simple or reused password. The good news: securing your accounts is not complicated once you follow a few rules that actually matter.

Rule 1: length beats complexity

A long password is usually stronger than a short one full of symbols. Modern guidance (including NIST) emphasizes length and checking against known breaches, not forced symbol soup that pushes people toward predictable patterns like Password1!. A long random multi-word phrase is both easier to remember and harder to guess.

Rule 2: one password per site

When a small site is breached and its passwords leak, attackers try the same email/password pair on other services (credential stuffing). If you reuse one password everywhere, a single leak means all your accounts.

Rule 3: use a password manager

Nobody can memorize dozens of long unique passwords. A password manager stores them encrypted while you remember a single long master password. Options include the browser's built-in manager and standalone apps; what matters is that the master password is strong and unique.

Rule 4: turn on two-factor authentication

Even if the password leaks, the second step blocks login. Start with email, banking and social accounts (the 2FA guide).

Rule 5: check for breaches

Sites like Have I Been Pwned tell you whether your email appeared in known breaches. If it did, change that site's password — and everywhere else you reused it.

Common mistakes

• Names, birthdays or phone numbers in passwords.
• Overused passwords like 123456 and qwerty.
• Saving passwords in a plain text file or unencrypted phone note.
• Sending passwords through messengers.
• Using the email password elsewhere — email is the recovery key to everything.

How to build a good passphrase

Pick four to six unrelated words, ideally from dice or a random generator (not a famous quote or song). Combine ordinary words that have nothing to do with each other, then give important accounts their own separate password.

For developers

If you build sites: never store user passwords in plain text. Hash them with a proper algorithm (bcrypt or Argon2) and limit login attempts. Real examples of what goes wrong are in school software security.