How to Create a Strong Password and Keep It Safe
If you run a website, you have a lot of accounts to protect: your hosting panel, your domain, your email, your analytics and your social profiles. One weak password can give an attacker control of all of them. The good news is that creating strong passwords is not difficult once you know the rules. This guide explains what makes a password strong and how to manage them without going crazy.
What makes a password strong?
Three things matter most: length, randomness and uniqueness.
- Length. Every extra character makes a password far harder to guess. Aim for at least 12 characters, and 16 or more for important accounts.
- Randomness. Strong passwords are not based on names, birthdays, pet names or common words. Attackers try those first.
- Uniqueness. Each account should have its own password. If you reuse one and a single website is breached, attackers try that password everywhere else.
Why common patterns are weak
Many people believe that swapping letters for symbols, such as using the @ sign instead of the letter a, makes a word safe. Attackers know these tricks, and their tools test them automatically. Passwords such as 123456, password, qwerty and a person's name followed by a year are guessed in seconds. Predictable patterns, even clever-looking ones, are weak.
Random passwords versus passphrases
There are two good approaches. The first is a fully random string of letters, numbers and symbols, which is excellent for accounts where a password manager fills it in for you. The second is a passphrase made from several unrelated words, such as four or five random words joined together. Passphrases are easier to remember and still strong because of their length. Use a passphrase for the few passwords you must type from memory, such as your password manager.
How to generate a strong password
- Open our Password Generator.
- Choose a length of at least 16 characters.
- Keep uppercase, lowercase, numbers and symbols turned on. If a website does not accept some symbols, turn symbols off and increase the length.
- Tap Generate and copy the result.
- Save it straight into a password manager.
Our generator runs in your browser and uses its secure random number source. The password is never sent or stored by us.
Use a password manager
Nobody can remember dozens of long random passwords. A reputable password manager stores them in an encrypted vault, creates new ones, and fills them in for you. You only need to remember one strong master passphrase. Many browsers and phones include a built-in manager, and dedicated apps are available too. Using one is far safer than writing passwords on paper or in a plain notes file.
Turn on two-factor authentication
Two-factor authentication, often shortened to 2FA, asks for a second proof of identity, such as a code from an app, in addition to your password. Even if someone steals your password, they cannot log in without that second step. Turn it on for your email, hosting, domain registrar and any account that offers it. Authenticator apps and hardware keys are generally safer than text message codes.
Protect the accounts that matter most
- Your email. It can reset every other account, so give it your strongest password and 2FA.
- Your domain registrar and hosting. Losing these means losing your website.
- Your search and analytics accounts. They control how your site appears in search.
- Your password manager. This is the key to everything else.
Habits to avoid
- Reusing one password across websites.
- Sharing passwords by email or chat.
- Saving passwords in plain text files.
- Entering passwords on websites you reached through email links. Type the address yourself.
- Ignoring breach alerts. If a service tells you it was breached, change that password immediately.
Do you need to change passwords often?
Current security guidance generally recommends changing a password when there is a reason, such as a suspected breach or a lost device, rather than on a fixed schedule. Forced frequent changes tend to produce weaker, predictable passwords. A long, unique password protected by two-factor authentication is a better defence.
Conclusion
Strong passwords are long, random and unique, and they are best managed by a password manager with two-factor authentication turned on. Protecting your accounts protects the website you have worked hard to build. Take ten minutes to update your most important passwords today, and you will be far safer for years.