How to Create a Strong Password and Keep It Safe
Your website, email and hosting accounts are only as safe as their passwords. Weak or reused passwords are one of the most common ways accounts get broken into. The good news is that strong password habits are easy to learn. This guide explains what makes a password strong and how to keep it safe.
What makes a password strong?
- Length. Longer is better. Aim for at least 12 to 16 characters, and more for important accounts.
- Randomness. Passwords made from real words, names, birthdays or patterns like "123456" or "qwerty" are guessed quickly.
- Variety. A mix of uppercase and lowercase letters, numbers and symbols increases the number of possible combinations.
- Uniqueness. Every account should have its own password.
Why you should never reuse passwords
When a company suffers a data breach, attackers try the leaked email and password pairs on other sites. This is called credential stuffing. If you reuse a password, one breach can open your email, your domain registrar, your hosting and more. A unique password for each account limits the damage to a single site.
Passphrases are a good option
A passphrase is a string of several unrelated random words, such as "orbit candle fabric lemon harbor". It can be long enough to be very strong while still being easier to remember. The words must be truly random, not a famous quote or a line from a song.
Use a password manager
No one can remember dozens of long random passwords, and writing them in a notes file or reusing a few is risky. A reputable password manager creates, stores and fills strong passwords for you, so you only need to remember one strong master password. Choose a well-known manager and protect it carefully.
Turn on two-factor authentication
Two-factor authentication adds a second step, such as a code from an app, after your password. Even if a password leaks, an attacker cannot log in without that second step. Enable it on email, banking, hosting, domain and social accounts first.
Habits to avoid
- Using personal details like your name, phone number or birthday.
- Sharing passwords by email or chat.
- Entering your password on a link you received in an unexpected message, since phishing pages copy real sites.
- Keeping the default password on a new router, CMS or hosting panel.
Generate one now
Try our Password Generator to create a random password with the length and character types you choose. It works in your browser and needs no account, but remember to store the result in a password manager straight away.
Conclusion
Use long, random, unique passwords, store them in a manager, and switch on two-factor authentication. Those three habits protect your website and accounts far better than any clever trick. Also see our SEO basics guide to protect your rankings by keeping your site secure and trusted.