Most password advice is stuck in 2005: add a capital, a number and a symbol. But the single biggest factor in whether a password survives an attack is its length, not how many symbols you sprinkle in. A long, memorable passphrase beats a short, cryptic password every time.
This guide explains what genuinely makes a password strong, how to build one you can actually remember, and the two habits that matter more than the password itself.
What you need
- ✓A few minutes to set up a system you'll reuse.
- ✓A password manager (strongly recommended) or a reliable way to remember one master passphrase.
- ✓A password generator for accounts you don't need to memorise.
Step-by-step
- 1
Understand what makes a password strong
Strength comes from unpredictability × length. Every extra character multiplies the number of guesses an attacker needs. A 16-character password is astronomically harder to crack than an 8-character one, regardless of symbols.
- 2
Build a passphrase for anything you must memorise
String four or more random, unrelated words together — 'copper-lantern-mango-drift'. It's long, easy to picture, and far stronger than 'P@ss1!'. Make it genuinely random, not a famous quote.
- 3
Use a generator for everything else
For accounts you don't type by hand, generate a long random password (16+ characters) and let a password manager store it. You never need to remember these.
- 4
Never reuse passwords
Reuse is the real danger: one breached site exposes every account sharing that password. A unique password per site means one breach stays contained.
- 5
Turn on two-factor authentication
Even a perfect password can be phished. 2FA (an authenticator app, not SMS where avoidable) blocks logins even when someone has your password.
Examples
- Weak: 'Summer2026!' — short, predictable pattern, cracked in seconds by modern tools.
- Strong and memorable: 'velvet-otter-gravel-summit' — four random words, long, easy to recall, extremely hard to guess.
- Strong and stored: 'x7$Kp2!vQ9mLz4Rt' — generated, never typed by hand, saved in a password manager.
Tips
- →Length wins: aim for 16+ characters. A long passphrase beats a short symbol-soup password.
- →Use a password manager so every account can have a unique, random password you never memorise.
- →Reserve your memory for one strong master passphrase — let software handle the rest.
- →Turn on 2FA everywhere it's offered, especially email, which can reset all your other accounts.
- →Avoid personal info (names, birthdays, pets) — it's the first thing attackers try.
Common mistakes
- Relying on symbols over length. Add words and length, not just a '!' — an 8-char symbol password is still weak.
- Reusing the same password. Use a unique password per site so one breach can't unlock everything.
- Basing it on personal details. Avoid names, dates and pets; use random words a stranger couldn't guess.
- Skipping 2FA. Enable two-factor authentication — a password alone can be phished or leaked.
Conclusion
A strong password is long, unique and unpredictable — and the easiest way to have one for every account is a password manager plus one memorable master passphrase. Add 2FA on top, and you've closed the doors attackers rely on most.