Most people know they should use strong passwords. Most people still do not, because strong passwords feel hard to remember and annoying to type. The good news is that a strong password does not have to be hard to remember — it has to be long, unique, and stored properly. This guide explains how to do all three without driving yourself mad.
What makes a password weak
A weak password is one an attacker can guess or find quickly. Common weak passwords include your name, your birthday, your pet's name, the name of your town, and simple sequences such as 123456 or qwerty. Attackers do not guess these by hand. They use lists of passwords leaked from past data breaches, and they try the obvious choices — including words from your social media profiles — automatically and at high speed.
Short passwords are weak even when they look clever. A six-character password made of random letters and numbers can be tried millions of times in seconds by a modern computer. Length is what slows an attacker down: every extra character multiplies the number of guesses required. That is why security advice has shifted away from complicated short passwords toward long ones.
The other problem is reuse. If you use the same password for your email, your bank, and a shopping site, then a breach at any one of those places exposes all of them. Attackers know this, and one of their first steps after stealing a list of passwords is to try each one on other popular sites. This is called credential stuffing, and it works because so many people reuse passwords.
What makes a password strong
A strong password has three qualities. First, it is long — at least 12 characters, and longer is better. Second, it is unpredictable — it does not contain your name, your birthday, or common words in an obvious order. Third, it is unique — you use it for one account only.
You do not need to memorise a random string of symbols to meet those rules. The easiest reliable method is the passphrase: four or five random words joined together. Something like "correct horse battery staple" is long, easy to remember, and hard to guess, because the words have no connection to each other. Pick words that mean nothing together, avoid famous phrases, and add a number or symbol somewhere if the site requires it. A passphrase you can picture is one you will actually remember.
Do not use song lyrics, famous quotes, or lines from books. Attackers include those in their guessing lists too. Do not use a keyboard pattern such as 1qaz2wsx, and do not simply add a "1" or "!" to the end of an old password when a site forces you to change it.
Use a password manager
The real solution to the memory problem is a password manager. It is an app that creates and stores a different random password for every site you use, and locks them all behind one master password — the only password you need to remember. When you need to sign in, the manager fills the password in for you.
Many phones and browsers already include a password manager, and there are well-known standalone apps as well. Whichever you choose, set it up properly. Your master password should be a long passphrase that you have never used anywhere else, and you should turn on two-factor authentication for the manager itself, so that even if someone learns the master password they still cannot get in.
A common worry is putting all your passwords in one place. It feels risky, but it is far safer than reusing the same password everywhere or keeping a list in a notebook or a notes app. A reputable password manager encrypts your passwords, which means they are scrambled into unreadable data unless the master password is entered. A notebook can be lost or photographed; a notes file can be copied in seconds.
Start with your most important accounts: email first, then your bank, then social media and shopping. Your email matters most, because anyone who controls it can request password resets for almost everything else. Once those are done, work through the rest a few at a time.
How to remember the ones you must type
Some passwords you still need to type yourself: your phone's lock code, your computer login, and your password manager's master password. For these, use passphrases and practise them for a few days. Typing a passphrase five or six times is usually enough to fix it in your memory. If you must write one down while you are learning it, keep the note somewhere private, away from your devices, and destroy it once you know the password by heart.
Do not store passwords in your browser's plain notes, in a spreadsheet named "passwords", or in a photo on your phone. Do not share them over chat or email, even with people you trust. If someone genuinely needs access to an account, most services offer a proper way to share it or add a second user.
What to do after a data breach
Data breaches happen regularly, and you will probably receive an email one day telling you that a service you use has been breached. Do not panic, but do act. First, change the password for that service. If you reused that password anywhere else, change it there too — this is exactly the situation unique passwords protect you from. Then check whether the breach included other details, such as your phone number or address, and watch for suspicious messages that use that information.
Some browsers and password managers can warn you when a password you use appears in a known breach. That warning is worth acting on the same day. Treat it as a prompt, not as a scare: change the affected password and move on.
Passwords are only part of the answer
Even a perfect password can be stolen if you type it into a fake login page, which is why you should also turn on two-factor authentication wherever it is offered. Two-factor authentication means that a password alone is not enough to sign in — the attacker would also need a code from your phone or a security key. It is the single most effective extra step you can take, and most major services offer it for free.
To sum up: make passwords long, make them unique, let a manager remember them, and add two-factor authentication on the accounts that matter. That combination protects you against the most common attacks without requiring you to memorise dozens of random strings. Set it up once, keep it up to date, and you will have solved the password problem for good.