Good Password: How to Create One

A good password is long, unique, and not based on personal information—think a random string of 12+ characters or a passphrase of 4–6 unrelated words. You create one by using a password manager to generate and store it, or by combining random words with numbers and symbols in a way you can remember but others can’t guess.

Why Length Beats Complexity

Many people think adding a “!” or “7” to a short word makes it secure. It doesn’t. A password like “P@ssw0rd!” is still short and predictable. Length is far more important because each extra character multiplies the number of possible combinations exponentially. For example, a 10-character lowercase password has 26^10 ≈ 1.4 × 10^14 combinations, while a 14-character lowercase password has 26^14 ≈ 6.4 × 10^19—about 450,000 times more. Adding uppercase, digits, and symbols does help, but only if the password is still long.

How to Choose a Password You Can Remember

The best method for humans is the passphrase approach: pick 4–6 random words and string them together. For instance, “correct horse battery staple” (made famous by a webcomic) is far stronger than “Tr0ub4dor&3” because it’s long and random. To make it even better, add a number or symbol, like “correct-horse-4-battery!”. The key is randomness—don’t use a quote, a song lyric, or words that relate to your life. Use a random word generator or dice to pick words.

Common Mistakes to Avoid

Reusing passwords across sites. If one site leaks, attackers try that same email/password on banking, email, and social media.
Using personal info like your name, birthday, pet’s name, or phone number. This is the first thing an attacker tries.
Substituting letters (e.g., “p@ssw0rd”)—attackers know these tricks.
Using common patterns like “qwerty”, “123456”, or “password”. They are the first guesses in any dictionary attack.
Sharing passwords or writing them on sticky notes visible to others.

Password Managers: The Real Solution

No human can remember a unique 16-character random password for every site. A password manager is a program that stores all your passwords in an encrypted vault, unlocked by one master password. It can generate strong random passwords for each site and auto-fill them. You only need to remember the master password (which should be a long passphrase). Popular options include free ones built into browsers and dedicated apps. The risk is low if you enable two-factor authentication on the manager itself. This is the single best step you can take for online security.

Two-Factor Authentication (2FA)

Even a strong password can be stolen via phishing or a data breach. Two-factor authentication adds a second check: something you have (like a phone) or something you are (like a fingerprint). Even if an attacker gets your password, they can’t log in without the second factor. Prefer app-based authenticators or hardware keys over SMS, because SMS can be intercepted. Use 2FA on your email, banking, and password manager at minimum.

How to Check If Your Password Is Already Compromised

Services like Have I Been Pwned let you enter your email address to see if it appeared in known data breaches. If it has, you should change the password on that site immediately, especially if you reused it elsewhere. You can also check individual passwords—the service will tell you how many times that exact password has been seen in breaches. Never enter your actual password into a random website; only use trusted services.

Frequently Asked Questions

How long should my password be?

At least 12 characters, but 16 is better. For critical accounts (email, banking, password manager), use 16–20 characters. With a password manager, you can easily use 20+ random characters.

Is a passphrase better than a random string?

Both are strong if truly random. Passphrases are easier to remember and type, but they are slightly weaker per character because words are not random letters. A 4-word passphrase from a 10,000-word dictionary has about 53 bits of entropy, while a 16-character random string has about 105 bits. Use 5–6 words or add a number/symbol to boost it.

Should I change my passwords regularly?

Only if you suspect a breach. Forcing frequent changes often leads to weaker passwords (like adding “1” to the end). Instead, use a unique strong password for each site and enable 2FA. Change a password immediately if you hear of a breach that affects that site.

What if I can’t use a password manager?

If you must remember passwords, use a passphrase for your most important accounts and make it unique. For less important accounts, you can reuse a strong passphrase, but that’s risky. At minimum, never reuse passwords for email, banking, or social media.

Are symbols and numbers necessary?

Not if your password is long enough. A 16-character lowercase passphrase is extremely strong. However, some sites require a mix of character types. In that case, add a digit and a symbol to a passphrase, like “correct-horse-4-battery!”.

Can I use a pattern on the keyboard?

No. Patterns like “qwerty” or “1qaz2wsx” are among the first guesses in automated attacks. They are not random, and attackers know them.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →