How to create strong passwords and passphrases

1. Length beats complexity

Attackers test billions of guesses a second against leaked password databases. Every extra random character multiplies their work, so a long password is far stronger than a short one with a symbol swapped in. P@ssw0rd! looks complex but is one of the first guesses tried.

Use at least 12 random characters for everyday accounts and 16 or more for important ones.

2. Let a generator choose

People are bad at being random. We pick names, dates, keyboard patterns and favourite words, and attackers' tools know these habits. A generator that uses a secure random source avoids them completely.

3. Use a passphrase for what you must remember

For the few passwords you type by hand, such as your computer login or the master password of your password manager, use 5 to 7 random words. Mango-Velvet-Ripple-Ocean-Banjo is easy to remember and much harder to crack than a short complex password.

4. Never reuse a password

When one site is breached, attackers try the same email and password on every other popular site. A unique password for each account limits the damage to one place. A password manager makes this practical: it creates, stores and fills in a different password for every site.

5. Turn on two-factor authentication

Two-factor authentication (2FA) asks for a code from your phone or a security key as well as your password. Even if your password leaks, the attacker cannot sign in. Use an authenticator app or passkey rather than SMS where possible.

Checklist

A quick check for your important accounts:

• Email first: it can reset every other password.
• 16+ random characters, or 6+ random words.
• A different password on every site.
• Saved in a password manager, not a note or spreadsheet.
• Two-factor authentication turned on.
• Change a password straight away if the site reports a breach.