Length beats tricks
A long password is much harder to guess than a short one with swapped letters. Each extra character multiplies the number of guesses needed. Aim for at least 14 characters, and 20 or more for email, banking and your password manager.
Rules that work
- Use a different password on every site, so one leak cannot unlock your other accounts.
- Make passwords random, not based on names, dates or pet names.
- Turn on two-step verification, ideally with an authenticator app.
- Change a password when you think it was exposed, not on a timer.
You do not need to remember them all
Use a password manager. You remember one strong passphrase and the manager stores the rest. Browsers and phones now include one, and dedicated apps offer more features.
Make one now
Our password generator creates a random password in your browser. It is not sent anywhere. Copy it straight into your password manager.
Passphrases
For the one password you must remember, use four or five unrelated words, such as a sentence nobody could guess. It is long and easier to remember than a jumble of symbols.
Mistakes that make passwords weak
Adding a number or exclamation mark to a word, using your name or birth year, reusing a favourite password with a small change, and keeping passwords in a notes app with no protection are the usual causes. Attackers try these patterns first.
What to do after a data breach
- Change the password for that site straight away.
- Change it anywhere else you used the same one.
- Turn on two-step verification.
- Watch your email and bank statements for anything unusual.