How to Create Strong Passwords and Use a Password Manager

A strong password is long, unique to one account, and not guessable from information about you. In practice the easiest way to get there is a password manager that generates and stores a different random password for every account, plus a long, memorable passphrase for the password manager itself. Adding two-factor authentication on top protects accounts even when a password leaks.

Why reuse is the biggest risk

When a website is breached, its usernames and passwords often end up in lists traded online. Attackers then try those combinations on other sites, a technique called credential stuffing. If you reuse a password, one breach elsewhere can unlock your email, hosting account or website admin.

Unique passwords for every account stop this completely.

Length beats complexity

Current guidance, including the US National Institute of Standards and Technology (NIST) digital identity guidelines, favours length over complicated composition rules:

• longer passwords and passphrases are much harder to guess;
• forced complexity rules ("one capital, one symbol") tend to produce predictable patterns like Password1!;
• forced regular changes lead to weak, incremented passwords, so they are no longer recommended unless there is evidence of compromise.

Passphrases

A passphrase is several random words, such as orbit-lantern-cabbage-velvet. Four or more randomly chosen words create a long password that is far easier to remember and type than a short jumble of symbols. Choose words randomly (a password manager can generate them), not a famous quote or song lyric.

Use a passphrase for the few things you must remember: your password manager, your computer login, and possibly your main email.

What to avoid

• Names, birthdays, phone numbers, company names or anything on your social media.
• Common passwords and keyboard patterns (123456, qwerty, password).
• Small variations of an old password.
• Storing passwords in plain text files, spreadsheets or chat messages.

Password managers

A password manager is an encrypted vault for your passwords. It can:

• generate long random passwords for each account;
• fill them in automatically, only on the correct website (which also helps resist phishing);
• sync across your devices;
• warn you about reused, weak or breached passwords;
• securely share selected logins with colleagues.

Choose a reputable manager with a good security track record, protect it with a strong passphrase and two-factor authentication, and keep its recovery details safe.

Business accounts and shared access

• Give each person their own account wherever the service supports it, rather than sharing one login. This makes access easy to remove when someone leaves and shows who did what.
• Where a shared login is unavoidable, share it through a password manager's sharing feature, not by email or chat, and change it when someone with access leaves.
• Keep an inventory of critical accounts: domain registrar, hosting, website admin, email, payment providers.

Getting started with a password manager in one afternoon

1. Choose a manager with a good reputation, apps for your devices and, for teams, sharing features.
2. Create a strong master passphrase of four or more random words, and store an emergency copy somewhere safe offline.
3. Turn on 2FA for the password manager itself.
4. Install the browser extension and phone app.
5. Start with the critical accounts: email, domain registrar, hosting control panel, website admin, banking and payment providers. Change each to a new, generated password as you add it.
6. Let the manager capture the rest as you log in to other sites over the following weeks.
7. Review its security report for reused and weak passwords and fix them gradually.

You do not need to fix everything on day one; securing the most important ten accounts first removes most of the risk.

Example: checking whether an email address appears in breaches

Services such as Have I Been Pwned let you check whether an email address has appeared in known data breaches. If yours has, change the password for the breached service and anywhere else you used the same password, and enable 2FA. Many password managers run similar checks automatically.

Add two-factor authentication

Even a strong password can be stolen by phishing or malware. Two-factor authentication adds a second check, such as a code from an authenticator app. Turn it on for every important account. See two-factor authentication explained.

For website owners: protect your users' passwords

If your website has user accounts:

• store passwords only as strong, salted hashes (frameworks like Laravel and WordPress do this by default);
• allow long passwords and paste, so password managers work;
• check new passwords against lists of known-breached passwords;
• limit login attempts; see brute-force attack prevention.

Frequently Asked Questions

Are browser password managers good enough?

Built-in browser managers have improved and are far better than reusing passwords. Dedicated managers often offer better sharing, cross-browser support and security features.

What if my password manager is hacked?

Reputable managers encrypt vaults so that the provider cannot read them; your master passphrase and 2FA protect the vault. Choose one with a strong track record and keep your master passphrase unique.

How often should I change passwords?

Change them when there is a reason, such as a breach, suspected compromise or someone leaving, rather than on a fixed schedule.

Related reading

Strong logins are step 2 of website security basics. For help securing a ServerNeed account, contact support.

Sources

• NIST SP 800-63B: Digital Identity Guidelines
• Have I Been Pwned