In short: a strong password is long (14 characters or more), random and different on every site. Store them in a password manager. On important accounts turn on sign-in with a code: signing in then takes both the password and the code.
Why simple passwords get cracked
Passwords are usually guessed by programs that check billions of options per second, starting with the most likely ones.
- Dictionaries. Popular passwords, words, names and dates go first. “Masha2008!” looks complex, but it is a name, a year and an exclamation mark, the most common pattern there is.
- Leaks. Sites get breached and password databases end up online. If you use one password everywhere, a leak on one site puts all of them at risk.
- Letter swaps. Programs know “P@ssw0rd” as well as “password”.
Length beats symbols
Every extra character multiplies the number of options. A long password of plain letters is stronger than a short one with symbols.
| Password | Length | Brute force would take |
|---|---|---|
| masha2008 | 9 | instantly, it is in dictionaries |
| X7#kq2!p | 8, all character types | hours |
| kvtnxpralmwoqe | 14, lowercase only | years |
| random 16 characters | 16, all types | longer than the universe exists |
Estimate for GPU brute force, around 10 billion guesses per second.
If you must remember it: a phrase instead
For a password you type by hand, like your computer or password manager login, use a phrase of four or five random words: “bucket sunset gear lemon”. Easy to remember, slow to crack. Pick each word at random: a ready-made song line is easy to guess.
How to keep a different password everywhere
Let a password manager store your dozens of random passwords:
- Bitwarden. Free, works on every device.
- KeePass and KeePassXC. Free, keep the vault locally with you.
- 1Password. Paid, very convenient.
- The one in your browser or phone. A basic option, already there.
You only remember one password, for the manager. It makes up and fills in the rest.
A second layer
Two-factor sign-in asks for a code from an app or SMS after the password. Even if the password leaks, nobody gets in without the code. Turn it on at least for email, messengers and banking: every other account is recovered through your email.
Check your email for leaks
On haveibeenpwned.com you can enter your email and see whether it was in known breaches. If it was, change the password on those sites and everywhere it was reused.
Summary
| Rule | Why |
|---|---|
| 14+ characters, random | Brute force takes a long time |
| Different on every site | Each account has its own password |
| Keep it in a password manager | Automatic storage and filling |
| Two-factor on important accounts | A stolen password is not enough |
| Check your email for leaks | Know when it is time to change |
Check it yourself Password generator A strong password that stays only in your browser Open 
