Strong Passwords Made Simple (and Why You Need a Password Manager)
A simple system for creating strong passwords you can remember, plus how password managers and two-step verification keep your accounts safe.
Most accounts aren't hacked by a genius guessing your password. They're broken into because the same password was used on another website that got breached, and criminals simply try it everywhere. Fixing that one habit makes you dramatically safer.
Rule 1: one password per account
If you reuse a password, one leak anywhere unlocks everything. Your email account matters most, because anyone who controls it can reset the passwords for almost everything else. Give it a unique, strong password first.
Rule 2: use three random words
The UK's National Cyber Security Centre recommends joining three random words, for example KettlePlanetMarble. That's long, which makes it hard to crack, and easy for you to remember. Add a number or symbol if a site insists: KettlePlanetMarble7!
Avoid things people can find out about you: pet names, football teams, birthdays and your children's names are the first things criminals try.
Rule 3: let a password manager do the remembering
A password manager is an app that stores all your passwords in an encrypted vault. You remember one strong master password and it fills in the rest. Good options include the free managers built into your phone and browser (Apple Passwords, Google Password Manager, Microsoft Edge) and dedicated apps such as Bitwarden, 1Password and Proton Pass.
Password managers also:
- create long random passwords for you
- only fill in your details on the real website, which helps protect you from fake login pages
- warn you if a saved password has appeared in a known data breach
Rule 4: turn on two-step verification
Two-step verification (also called 2FA or multi-factor authentication) means that even with your password, someone also needs a code from your phone. Turn it on for email, banking, social media, shopping and anything that stores your card. Look in the account's Security settings.
What about passkeys?
Passkeys replace passwords altogether. You sign in with your fingerprint, face or phone PIN, and there's nothing for a scammer to steal or trick out of you. When a site offers to create a passkey, it's usually worth saying yes.
A 15-minute action plan
- Change your email password to three random words and turn on two-step verification.
- Do the same for your bank and your Apple, Google or Microsoft account.
- Pick a password manager and save those passwords in it.
- Over the next few weeks, update other accounts as you log in to them.
Want to check whether your email has appeared in a breach? The free service Have I Been Pwned lets you search. If it has, change that password and any copies of it.