Strong passwords made easy

Why passwords still matter

Your password is the key to your digital front door: your email, bank, shopping and social media. If a criminal gets it, they can read your messages, spend your money or pretend to be you.

Criminals rarely "guess" passwords one by one. They use computer programs that try millions of common passwords very quickly. They also use passwords stolen from websites that have been broken into. If you used the same password elsewhere, they try it there too.

Some old password advice actually made things worse. Being forced to change passwords every month, or to swap letters for symbols (like P@ssw0rd), led people to pick predictable patterns that computers guess easily. Today the focus is simpler: make passwords long, make each one unique, and change a password when there is a reason to, such as a leak or a suspicious login.

The two big mistakes

1. Weak passwords. Things like 123456, password1, your pet's name or your birthday are among the first things those programs try.

2. Reusing passwords. This is the bigger problem. Imagine using one key for your house, car and office. If someone copies it, they can open everything. When one website leaks your password, every account using that same password is at risk.

Tip: Your email password is the most important of all, because "forgot password" links for your other accounts go to your email. Give it its own unique, strong password.

The three random words method

Long passwords are much harder to crack than short complicated ones. A simple way to make a long password you can remember is to join three random words. This approach is recommended by the UK's National Cyber Security Centre.

1. Pick three words that have nothing to do with each other or with you, for example CactusTrumpetPillow. (Do not use this example.)
2. Avoid obvious combinations such as family names, your football team or a famous phrase.
3. If a website insists, add a number or symbol: CactusTrumpetPillow7!
4. Picture a silly scene, like a cactus playing a trumpet on a pillow, to help you remember it.

Want to test one? Our password strength checker shows how strong a password is, and the password generator can create random ones for you. Both run in your browser. Even so, it is good practice not to type your real, current passwords into any website other than the one they belong to.

Let a password manager do the remembering

Nobody can remember a different strong password for fifty websites. A password manager solves this. It is like a locked safe for your passwords. You remember one strong main password (three random words is ideal) and the safe remembers the rest.

• Most phones and web browsers have one built in, and there are well-known separate apps too.
• It creates long random passwords for you when you sign up somewhere new.
• It fills them in automatically, and only on the correct website, which also helps protect you from fake sites.
• It syncs between your phone and computer.

Getting started this week

1. Change your email password to three random words that you do not use anywhere else.
2. Turn on 2-step verification for your email, then your bank and social media. See turn on 2-step verification.
3. Set up a password manager, starting with the one built into your phone or browser if you are unsure.
4. Fix reused passwords a few at a time, starting with the most important accounts.
5. Never share passwords by text or email, and never tell one to someone who calls you.

Writing passwords in a notebook kept safely at home is better than reusing one weak password everywhere, but a password manager is safer and more convenient. For a deeper look, read our technical note on strong passwords and MFA.