What really matters
Almost all password advice boils down to three points:
- A different password for every account. It is the rule that protects you most and the one people follow least.
- Long and randomly generated. 16 characters or more if a password manager stores it; a passphrase of 6 or 7 words if you have to remember it.
- Kept in a password manager, not in your head or in a file on your desktop.
Add two-factor authentication (a code or key on top of the password) to your email and your bank, and you are ahead of the vast majority.
The biggest risk: reusing passwords
Most accounts are not lost because someone guesses the password, but because it leaked somewhere else. When a small website is breached, attackers automatically try the same email and password pairs on hundreds of services: email, shops, social networks, banks. It is called credential stuffing, and it works because so many people use the same password everywhere.
It does not matter how strong the password is: if you use it on ten sites, it only takes one of them storing it badly. With unique passwords, a breach only affects one account.
Length over complexity
Every extra character multiplies the possible combinations. Requiring “one capital, one number and one symbol” only adds something if the password is random; when a person picks it, the result is almost always a word with a capital first letter and a digit and a symbol at the end. Attack tools try exactly that first.
| Password | What happens |
|---|
| P@ssw0rd! | Meets every complexity rule and is on every breach list. Cracked instantly. |
| Liverpool2026! | Common word, year and symbol: a pattern that gets tried in seconds or minutes. |
| k7#Qm2vX | Random but short: 8 characters is about 51 bits, around a day in an offline attack. |
| velvet-canyon-lantern-pebble-anchor-steam | 6 random words: 77 bits. Thousands of centuries, and you can memorize it. |
| vR9#tq!Lw2^mZx8&Pk4s | 20 random characters: 130 bits. Impossible to guess, and impossible to remember: one for the password manager. |
NIST’s guideline, revised in 2025, puts it this way: at least 15 characters if the password is the only protection on the account, no mandatory composition rules and no periodic expiry.
Tricks that no longer work
Swapping letters for numbers
Writing p4ssw0rd instead of password fools nobody. Every attack tool has tried those substitutions automatically for more than a decade.
A base password plus the site name
Something like Rover1987-netflix and Rover1987-amazon. It looks as if you have different passwords, but as soon as one leaks, the pattern is visible and the rest can be worked out.
Personal details
Children’s or pets’ names, dates, sports teams, the street you grew up on. Much of that is on your social media, and it is the first thing someone who knows you would try.
Changing it every 90 days
It forces you to remember new passwords constantly, and the result is Spring2026 followed by Summer2026. Today the advice is to change it only when there is a reason.
A five-step plan
You do not have to change everything in one evening. This order protects what matters most first:
- Choose a password manager. Bitwarden (free and open source), 1Password, KeePassXC (no cloud) or the one your system already has (Apple Passwords, Google Password Manager). Any of them is far better than none.
- Create the master password as a 7-word passphrase with the passphrase generator. Write it on paper and keep it at home until you know it by heart.
- Protect your main email with a new randomly generated password and two-factor authentication. Whoever controls your email can reset the password of every other account.
- Change your critical accounts: bank, Apple or Google, social networks and shops with your card saved. Use the generator at 20 characters.
- Everything else as you go. Each time you log in somewhere with an old password, change it for a generated one. Within a few months you will have done them all.
Before you start, check whether any of your current passwords already circulate in breaches.
Password checkerThe few you must memorize
With a password manager you only need to remember two or three: the manager’s master password, your computer or phone login and, if you like, your email. For those, a passphrase is much easier to remember than a string of symbols and just as strong, as long as a generator picks the words and you do not.
Passkeys: what comes next
More and more services (Google, Apple, Microsoft, Amazon, PayPal) let you sign in with a passkey: your device stores a cryptographic key that you unlock with your fingerprint, face or phone PIN. There is nothing to guess or leak, and it will not work on a fake site. If a service offers one, turn it on. In the meantime passwords are still needed almost everywhere, and everything in this guide still applies.