How to create a strong password

How passwords get cracked

• Credential stuffing: trying email and password pairs leaked from other sites.
• Dictionary attacks: trying common passwords, words and names with typical changes.
• Pattern attacks: keyboard rows, sequences, dates and repeated characters.
• Brute force: trying every combination, which only works for short passwords.

Length beats complexity

Each extra character multiplies the number of guesses. A 16-character password of random lowercase letters is far stronger than an 8-character one with every type of symbol. Current advice, including from NIST, is to favour long passwords and passphrases over forced complexity rules.

Build a passphrase

Choose 4 to 6 words at random, for example by rolling dice against a word list, not by picking a phrase you like. Join them with spaces or dashes. A passphrase like 'river-candle-orbit-mango' is easy to type and remember but very hard to guess, as long as the words are truly random.

Protect accounts beyond the password

• Use a password manager so every site gets a unique random password.
• Turn on two-factor authentication, preferably with an authenticator app, a passkey or a security key.
• Watch for breach alerts and change affected passwords quickly.
• Never share passwords by email or chat, and be careful with login links in messages.