Strong passwords that actually work
Length beats complexity. Learn how to build passwords that are genuinely hard to crack, why every account needs its own, and why you should stop changing them on a schedule.
The short version
A long passphrase beats a short, complex password. Use a different one for every account, let a password manager remember them, and turn on a second factor wherever you can. You do not need to change your passwords on a schedule — only when there is a reason to.
Most advice about passwords is out of date. The rules many of us grew up with — mix in a symbol, a number, a capital letter, and change it every 90 days — came from an era before attackers had cheap, fast hardware and stolen password lists numbering in the billions. Modern guidance, including the US government's own NIST SP 800-63B, says something simpler: make it long, make it unique, and stop rotating it for no reason.
Length is what matters
The single biggest factor in whether a password survives a cracking attempt is how long it is. A four-word passphrase like "correct-harbor-violin-sunrise" is far harder to break than a short string like "P@ssw0rd!" — and it is much easier to type and remember. Aim for a passphrase of four or more unrelated words, or at least 16 characters. If a site imposes complexity rules, satisfy them, but never let a symbol requirement talk you into a short password.
- **Longer is stronger.** Four random words beats eight clever characters.
- **Random, not guessable.** Avoid names, birthdays, sports teams, and anything on your social media.
- **Don't reuse.** A password that protects one account should protect only that account.
- **Don't share it** — not with colleagues, not over chat, not "just this once" with someone who called claiming to be IT.
Every account needs its own password
The reason reuse is so dangerous is a technique called credential stuffing. When one website is breached, attackers take the leaked email-and-password pairs and try them automatically against hundreds of other sites — your bank, your email, your work login. If you reused the password, one breach you never heard about unlocks everything. A unique password per account contains the damage to the one site that was actually breached.
"I just add a number to the end for each site"
Patterns like BankPass1, EmailPass2 are trivial for attackers to guess once they see one of them. A predictable variation is not a unique password. Let a password manager generate a genuinely random one for each site instead.
Stop changing passwords on a schedule
Forced periodic changes — the "your password expires in 5 days" nag — actually make security worse. People respond to them by making small, predictable tweaks or by choosing weaker passwords they can remember through the churn. Modern guidance is explicit: change a password only when there is evidence it may have been exposed, such as a breach notification or a login you don't recognize. Otherwise, a strong unique password can stay put.
Let a password manager do the remembering
Nobody can memorize a hundred unique 16-character passwords, and you shouldn't try. A password manager generates strong random passwords, stores them encrypted, and fills them in for you. You remember one strong master passphrase; it remembers the rest. See our guide to password managers for how to get started.