Password Security: A Practical Guide

Why passwords still matter

Stolen and guessed passwords remain one of the most common ways accounts get broken into. When a website is breached, attackers try the leaked email-and-password combinations on other popular sites. This is called credential stuffing. If you've reused that password, every account that shares it is at risk.

What makes a password strong

Length matters more than complexity. A long passphrase made of several random words is both stronger and easier to remember than a short jumble of symbols.

• Long: aim for at least 12–16 characters; longer is better.
• Unique: a different password for every account. This is the most important rule.
• Unpredictable: avoid names, birthdays, addresses, sports teams and common patterns like Password1! or qwerty123.
• Random words work: four or more unrelated words, such as lantern-orbit-cactus-violin, make a strong passphrase. (Don't use this example.)

Use a password manager

Nobody can remember dozens of unique, long passwords. A password manager remembers them for you. You only need one strong master password.

• It generates strong, random passwords for every site.
• It fills them in automatically, and only on the real website, which also helps protect you from fake login pages.
• It syncs securely between your computer and phone.
• Many browsers and phones include a built-in password manager; dedicated password manager apps add extra features like secure sharing for teams.

Add two-factor authentication

Two-factor authentication (2FA) means a stolen password alone isn't enough to get into your account. Turn it on first for your email, your bank, your password manager and any work accounts. See our full two-factor authentication guide.

What to do if a password leaks

1. Change the password on that site immediately, using a new unique password.
2. Change it anywhere else you used the same or a similar password.
3. Turn on two-factor authentication if you haven't already.
4. Check the account for changes you didn't make: forwarding rules in email, new devices, changed recovery details.
5. Be extra alert for phishing emails that mention the breach.

Reputable breach-notification services, such as Have I Been Pwned, let you check whether your email address has appeared in known data breaches.

Common mistakes to avoid

• Writing passwords on sticky notes on your monitor.
• Sending passwords by email or text message.
• Sharing one login among several staff members. Use separate accounts or a team password manager.
• Answering security questions truthfully with facts anyone could find online. Treat the answers like extra passwords.
• Ignoring "new sign-in" alerts.