How to Create a Strong, Unique Password

A strong password helps keep other people out of your accounts, while a different password for each account limits the damage if one is exposed. You’ll need a password manager or a safe way to store passwords, plus a few minutes to update important accounts. The steps below explain how to create, store, and maintain passwords without relying on hard-to-remember tricks.

What You’ll Need

• A reputable password manager, such as one built into your device or browser, or a dedicated password-management app. Check that you can access it on the devices you use and understand its recovery options.
• Access to the accounts you want to protect, starting with your email account and other important accounts.
• A way to use multifactor authentication (MFA), if the account offers it. This may be an authenticator app, security key, or another approved method.

Step-by-Step

1. Start with your most important accounts. Prioritize your primary email, password manager, financial services, cloud storage, and accounts that can reset passwords elsewhere. Email is especially important because password-reset links often arrive there. If you suspect an account is already compromised, use its official recovery process from a device you trust before changing credentials.
2. Choose a password manager and secure it. Use a well-maintained manager from a source you trust. Create a strong, unique master password for it, and turn on MFA if available. Save the manager’s recovery information somewhere separate and secure; losing access to the manager can make stored passwords difficult or impossible to retrieve. Avoid storing the master password in the same unlocked location as the vault.
3. Generate a unique password for each account. Use the manager’s generator when the site allows it. A practical default is a random password of at least 16 characters, using a mix of letters, numbers, and symbols if accepted. Longer is generally better, but the password should be generated randomly rather than assembled from personal details or a familiar phrase. Follow the site’s stated length and character rules.
4. Check the site’s password requirements. Some services limit length or reject certain characters. If a generated password is refused, read the on-screen rules and adjust the generator to match them. Do not weaken the password more than necessary, and do not substitute an obvious pattern such as a name followed by a year. If a site has an unusually restrictive limit, use the strongest unique password it accepts.
5. Save the password in the manager. Store it against the correct website or app entry, and check that the saved address matches the real service. A manager can help fill credentials on familiar sites, but pause before approving a prompt on a lookalike domain. Never share a password through an ordinary message or reuse it as a note on an unrelated account.
6. Update the account and verify the change. Open the service through its official app or by typing its known address. Find the password or security settings, enter the current password if requested, then set the new one. Save the updated credential when prompted. Sign out and sign back in, or otherwise confirm the new password works, before moving on.
7. Turn on MFA and review recovery details. Where offered, enable MFA using a method supported by the service. Store backup codes in a secure place separate from the account and password manager. Confirm that your recovery email and phone number are current. MFA adds another barrier, but it does not make a reused or exposed password safe.
8. Replace reused or exposed passwords. Change any password used on more than one service, starting with the most important accounts. If a service notifies you of a breach or you see suspicious sign-in activity, change that account’s password and any reused copies. Use the service’s sign-out-of-other-sessions option if available, and review recent activity for changes you did not make.

Common Mistakes

• Reusing a favorite password: If one service is breached, attackers may try the same credentials elsewhere. Give every account its own password.
• Making predictable variations: Changing “Summer2024!” to “Summer2025!” is not a reliable way to create a new secret. Use random generation instead.
• Using personal information: Names, birthdays, pets, teams, and other details may be guessed or found online. Do not treat obscure personal facts as a substitute for randomness.
• Trusting length alone: A long, familiar sentence or a predictable sequence can still be guessable. Length helps most when the password is random or a genuinely unpredictable passphrase.
• Saving passwords where they are easy to steal: Avoid plain-text files, notes shared across devices without protection, and messages. A secure password manager is designed for storing credentials.
• Changing passwords on a fake site: A convincing message may link to a lookalike login page. Navigate to the service directly rather than following an unexpected password link.

Tips

• Let a password manager create and fill passwords; memorizing every unique password is unnecessary. You mainly need to protect access to the manager.
• If you must memorize one password, use a long passphrase made from several randomly selected, unrelated words. Do not use a famous quotation, song lyric, or phrase associated with you. A manager-generated password is usually easier to make highly random.
• Keep your devices and password manager updated, use a screen lock, and avoid entering credentials on shared or untrusted devices.
• Do not change a strong password on a fixed schedule just for the sake of it. Change it promptly if it is exposed, reused, shared, or suspected of being compromised, and follow any specific requirement from the service.
• Use MFA wherever practical, especially on email and the password manager. Prefer phishing-resistant options such as a security key or passkey when the service supports them and they suit your situation.

Troubleshooting

The website rejects the password: Check its displayed rules for length, permitted characters, or other restrictions. Generate another password that meets those rules. If it still fails, try the service’s official password-change process in a current browser or app; do not paste the password into third-party troubleshooting sites.

The new password does not work: Check that the manager saved the change to the right account and website. Make sure autofill is not inserting an older password or the wrong username. Type the saved password carefully, checking keyboard layout and accidental spaces. If necessary, use the service’s official reset flow and save the replacement immediately.

You cannot access your password manager: Use its official recovery instructions and the recovery information you saved earlier. Avoid unofficial support links or anyone asking you to disclose your master password or backup codes. If recovery is unavailable, reset accounts through each service’s verified process and record new credentials in a secure manager.

You think someone has accessed an account: From a trusted device, change the password to a new, unique one, enable MFA, and review recent sign-ins and account recovery details. Sign out other sessions if possible. If you cannot sign in, contact the service through its official help or account-recovery page.

Frequently Asked Questions

How long should a password be?
A random password of at least 16 characters is a useful practical target when the service allows it. Longer passwords can be stronger; use the service’s actual limits.

Are passphrases safer than random passwords?
A long passphrase can be strong if its words are selected unpredictably. A familiar quotation or a phrase containing personal details is not a good substitute for randomness.

Is it safe to use a password manager?
A reputable, maintained manager is generally safer than reusing passwords or storing them in plain text. Protect its master password, enable MFA when available, and keep recovery details secure.

Should I change my passwords regularly?
Change a password when it may have been exposed, is reused, or is otherwise at risk. Routine changes without a reason can lead to weaker, predictable variations.

What should I do if a password appears in a breach?
Change it on the affected service and anywhere else you reused it, using a separate password for every account. Enable MFA and check the accounts for unfamiliar activity.

Can I share a password with someone I trust?
Avoid sending it in ordinary email or chat. If sharing is genuinely necessary, use a secure sharing feature offered by your password manager, then change or revoke access when it is no longer needed.

Related

• ChatGPT Character Input Limit: What You Can Send
• Customize ChatGPT Traits in the New Settings Menu
• Find Your Way Without a Smartphone or GPS