How to Create a Strong Password: Simple Steps That Work

Most of us have a handful of passwords we reuse everywhere, tweak slightly when a site demands a capital letter, and hope for the best. It's understandable, but it's also exactly what criminals count on.

Here's how I'd explain it, based on the official advice from the UK's National Cyber Security Centre (NCSC) and the US agency CISA. The good news is that the advice has become simpler over the years, and a strong password doesn't have to look like a jumble of symbols.

What makes a strong password strong

Length and unpredictability do most of the work. CISA's guidance says longer is stronger and recommends at least 16 characters. It also stresses that every account should have its own password, so that one breach doesn't open the rest.

The NCSC adds a point that surprises people: swapping letters for similar-looking numbers, like an o for a zero, adds little strength because criminals already know the trick. A long, unusual password beats a short, fiddly one.

The three random words method

The NCSC's headline advice is to combine three random words to make a password. Its example, applenemobiro, is long enough and strong enough, and it's far easier to remember than a string of random characters.

The word 'random' is doing the heavy lifting. Don't pick words from a favourite song, a line you know well or something connected to you. A few ways to keep it unpredictable:

• Pick words that have nothing to do with each other.
• Avoid significant dates, sports teams, and the names of family members or pets, which the NCSC notes are easy to guess from social media.
• Skip the old habit of changing letters into numbers.
• Make it longer rather than more complicated.

Passphrases of four to seven words

CISA suggests a similar approach. It describes a passphrase of four to seven unrelated words as an alternative to a random mix of upper-case and lower-case letters, numbers and symbols. Spaces are optional. It gives HorsePurpleHatRun as a good example and HorsePurpleHatRunBay as a stronger one, which shows the pattern: another word makes the password stronger.

Both agencies are saying the same thing in different ways. Pick several words, keep them unrelated, and let length protect you. Don't use either of those exact examples, of course, because published examples are the first things people try.

Why one password per account matters

When a website is breached, the stolen logins don't stay with that site. Criminals try them elsewhere, which the NCSC calls credential stuffing. If your streaming account password is also your email password, a breach on a small site could put your inbox at risk.

Your email deserves your strongest, most unique password because it's usually how every other password gets reset.

Using a password manager for strong passwords

Nobody can remember dozens of long, unique passwords. The NCSC says a password manager lets you use a different password for each account without having to remember them. It can generate strong passwords and fill them in for you. CISA adds that a manager can flag weak or reused passwords.

The NCSC describes it as safe to let your browser or device save passwords on your own devices, with two cautions. Browser-saved passwords are only as secure as your devices and accounts, so keep updates switched on. On a shared or public device, never save a password in the browser.

With a dedicated manager you only need to remember one primary password, so make that your strongest passphrase. The NCSC also advises turning on 2-step verification for the manager account, so a criminal who knows the primary password still can't get in.

Writing a strong password down

The NCSC says that writing a password down is acceptable if you keep it somewhere safe. A notebook in a drawer at home is a smaller risk than reusing one password online, which is what criminals exploit. Don't leave it on a sticky note on your monitor or in a bag you carry around.

Add a second step to your strong password

Even the best password can be stolen through phishing or a data breach, so pair it with a second check. My guide to two factor authentication explains the options and which accounts to protect first. CISA specifically points to email, social media and financial accounts.

A short checklist for choosing a strong password

1. Choose three or more random, unrelated words, or a longer passphrase.
2. Aim for at least 16 characters if the site allows it.
3. Use a different password for every account, starting with your email.
4. Keep names, dates and obvious facts out of it.
5. Store passwords in a password manager, or somewhere safe if you write them down.
6. Turn on 2-step verification wherever it's offered.

Share your own online safety knowledge

If you enjoy helping people stay safe online, there's room for clear, practical writing on the subject.

If you write about staying safe online, here are security sites open to outside writers.

Frequently asked questions

How long should a strong password be?

CISA recommends at least 16 characters. The NCSC's three-random-words example, applenemobiro, is long enough and strong enough in its view.

Are passwords with symbols better than passphrases?

Not necessarily. The NCSC says swapping in symbols or numbers adds little because criminals know the trick. Length and unpredictability matter more.

Is it safe to save passwords in my browser?

The NCSC says it's safe on your own devices, provided your devices and accounts are secure and updates are on. Never do it on a shared or public device.

Should I change my passwords regularly?

Neither source I read says to change them on a schedule. The sensible rule is to use a unique, strong password for each account and replace one if you think it has been exposed.

What's wrong with using the same password everywhere?

If one site is breached, criminals can try the stolen login on your other accounts. A different password for each account limits the damage.