How to create a strong password and remember it
Most hacked accounts are not broken into by a genius guessing your password. Attackers take a password leaked from one website and try it everywhere else. A strong password is long, random and used on one site only. Here is how to manage that without memorizing fifty of them.
Length matters more than symbols
Every extra character multiplies the number of possible passwords. An 8-letter lowercase password has about 209 billion combinations, which modern password-cracking hardware can run through quickly. A 16-character password using letters, numbers and symbols has more combinations than could be tried in many lifetimes.
So "P@ssw0rd!" is weak even though it has a capital, a number and symbols. It is short and follows a pattern that attackers try first.
What to aim for
- At least 14 to 16 characters for important accounts.
- Random, with no names, birthdays, pet names or keyboard patterns like qwerty.
- Different for every account, so one leak cannot open the others.
Create one in seconds
- Open the Password Generator.
- Set the length to 16 or more.
- Keep uppercase, lowercase, numbers and symbols turned on. If a site rejects symbols, turn that option off and add a few more characters.
- Tap Copy and paste it into the sign-up form.
The password is created on your own device and is not sent or stored anywhere.
How to remember them: don't
Nobody can memorize dozens of random passwords. Use a password manager, which stores them all and fills them in for you. Good options are already on your devices: Google Password Manager on Android and Chrome, and Passwords on iPhone and Mac. Stand-alone managers such as Bitwarden and 1Password work across every device.
You then need to remember only one master password. For that one, use a passphrase: four or five unrelated words, such as "lantern-orbit-cactus-violin". It is long, easy to type and hard to guess. Do not use that example or a famous quote.
Turn on two-step verification
With two-step verification, signing in needs your password plus a code from your phone. Even if your password leaks, the attacker cannot get in. Turn it on first for email, because email can reset every other account you own.
When to change a password
Changing passwords on a schedule is no longer recommended. Change one when a site tells you it was breached, when you shared it with someone, or when you typed it on a device you do not trust.