The short answer
Make every password long (at least 16 characters), random and unique. A phrase of four or more unrelated words is strong and easy to remember. Never reuse a password across accounts. Use a password manager to store them, and turn on two-factor authentication for email and banking.
Most accounts aren’t broken into by a genius hacker guessing your password. They’re opened with a password that leaked from some other site, because it was reused. That’s why the two most important rules are simple: make passwords long, and never use the same one twice.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends that every password be long, random and unique.
What makes a password strong
- Long: CISA recommends at least 16 characters.
- Random: not based on your name, pet, birthday, team or a common phrase.
- Unique: used for one account only.
A strong password isn’t about clever substitutions like P@ssw0rd!. Attackers’ tools know those tricks. Length and randomness are what make guessing impractical.
The passphrase method
A passphrase is a string of unrelated words. It’s long, hard to guess and much easier to remember than a jumble of symbols.
- Pick four to six random words that don’t belong together, for example:
harbor velvet pencil thunder orbit. - Join them with spaces, hyphens or capital letters:
Harbor-Velvet-Pencil-Thunder-Orbit. - Add a number or symbol if a site insists.
Avoid song lyrics, quotes and famous phrases. They’re in attackers’ word lists. If you want truly random words, our free Password Generator can create passphrases on your device.
Why reuse is the real danger
When any website is breached, attackers try the leaked email and password combinations on other sites, like email, banking and shopping. If you reused that password, they get in without guessing anything.
You can check whether your email appeared in known breaches at haveibeenpwned.com. If it did, change that password everywhere you used it. Our guide to what to do after a data breach walks you through it.
Which accounts to fix first
You don’t have to change everything today. Start where it matters most:
- Email: whoever controls your email can reset almost every other password.
- Banking and payment apps.
- Your phone account (Apple ID, Google account, mobile carrier).
- Social media and shopping accounts with saved cards.
Make it manageable
Nobody can remember dozens of unique passphrases. That’s what a password manager is for: it creates and remembers strong passwords so you only need one master passphrase. Then add two-factor authentication to your most important accounts, or switch to passkeys where they’re offered.
Test your password safely
Our Password Strength Checker estimates how long a password would take to crack, right in your browser. Nothing you type is stored or sent to us.
Related guides
The easiest way to keep a different password for every account is a password manager. For even better protection, look at passkeys, which replace passwords altogether.
The bottom line
Long, random and unique beats short and clever every time. Start with your email password, use a passphrase, never reuse it, and let a password manager handle the rest.
Frequently asked questions
Do I need symbols and numbers in every password?
Length matters most. A long, random passphrase is stronger than a short password with a few symbols swapped in. Add symbols or numbers if a site requires them.
How often should I change my passwords?
You don't need to change strong, unique passwords on a schedule. Change a password right away if the site had a breach, you shared it, or you see suspicious activity.
Is it safe to test my password on a website?
Only use a checker that works in your browser and doesn't send your password anywhere. Our Password Strength Checker runs on your device; the optional leak check sends only a tiny fragment of a scrambled version.
Why you can trust this guide
- Based on official sources. The steps here are checked against the 3 official sources listed below, such as the help pages of the companies involved.
- Checked and dated. Last checked on November 10, 2026. We update guides when software or advice changes.
- Independent. No company paid for or reviewed this guide. We don't sell products, and ads never influence our advice.
- Open to corrections. Spotted an error? Tell us and we'll fix it. Read how we research.
Sources
- CISA — Use Strong Passwords
- CISA — Turn On Multifactor Authentication
- Have I Been Pwned — Check if your email has been in a data breach
This guide is general information. Menus and features can change with software updates, and steps may differ on your device or version. Back up important data before making big changes. Read our disclaimer.
