How to Choose a Strong Password

Length beats cleverness

Every character you add multiplies the number of possibilities an attacker must try. Every substitution trick you apply — a zero for an O, an at sign for an A — adds almost nothing, because the software doing the guessing has known those patterns for decades.

This is why guidance from bodies such as NIST has moved firmly towards length and away from mandatory composition rules. A long password made of ordinary characters is stronger, and far easier to type, than a short one bristling with symbols.

The rules that turned out to be harmful

Forcing an uppercase letter, a digit and a symbol produces Password1! in millions of accounts. Forcing a change every ninety days produces Password1!, then Password2!. Both rules pushed people towards predictable patterns while making passwords more irritating to use, and modern guidance recommends dropping them — changing a password on evidence of compromise rather than on a calendar.

Two approaches that work

A generated random string, stored in a password manager. You never type it or remember it, so its unreadability costs you nothing. Twenty characters of mixed types is comfortably beyond brute force.

A passphrase of four or five unrelated words, for the handful of passwords you must actually remember — your device login and the master password for the manager itself. Choose the words at random rather than composing a sentence, because a memorable phrase from a song or a book is in the wordlists already.

Reuse is the real vulnerability

Most account takeovers do not involve guessing anything. Attackers take username and password pairs from one breached service and try them everywhere else, which works because so many people reuse credentials. A unique password per site turns any single breach into a single problem. This matters more than the strength of any individual password.

Turn on a second factor

Two-factor authentication defeats the entire class of attacks based on a stolen or guessed password. An authenticator app or a hardware key is meaningfully better than SMS, which is vulnerable to number transfer attacks — but SMS is still a large improvement over nothing. Enable it first on your email account, because that is the account that can reset all the others.

Where to start if this feels like a lot

Install a password manager and let it generate new passwords as you sign in to things over the coming weeks, rather than trying to fix a hundred accounts in one sitting. Deal first with email, then banking, then anything holding a payment method. Check whether your addresses appear in known breaches, and treat any password you have reused as already compromised.