Your passwords protect your email, bank, social media and shopping accounts. Yet millions of people still use passwords like 123456, password or their pet’s name, and reuse the same password everywhere. Hackers know this and use automated tools to test billions of guesses and leaked passwords. This guide explains how to create a strong password that is hard to crack but easy for you to remember, with examples, a comparison of methods and the most common mistakes to avoid.
What makes a password strong?
| Factor | Weak | Strong |
|---|---|---|
| Length | 8 characters or fewer | 14 to 16 characters or more |
| Uniqueness | Same password on many sites | Different password for every account |
| Predictability | Names, birthdays, keyboard patterns | Random words or random characters |
| Personal info | Uses your name, pet, team or city | Nothing linked to you |
| Leaked | Appears in breach lists | Never used or leaked before |
Length matters most. Every extra character multiplies the number of guesses a hacker must make. A random 16-character password or a five-word passphrase would take far longer to crack than an 8-character password with symbols.
Method 1: The random passphrase (recommended)
A passphrase is a string of random, unrelated words. It is long, strong and surprisingly easy to remember.
- Pick four to six random words, ideally using a generator or dice, not words that form a sentence you would say.
- Join them with hyphens, spaces or a symbol.
- Optionally add a number or capital letter if a site requires it.
Examples (do not use these exact ones):
- velvet-tractor-mango-orbit
- Lantern7-Pebble-Cactus-Drum
- quiet river basket comet violin
These are easy to picture and type, but very hard for computers to guess because there are so many possible word combinations.
Method 2: Random characters from a password manager
A password manager can generate passwords like t9#Vq2!mWz8@Lp4s. These are extremely strong, and you do not need to remember them because the manager fills them in automatically. This is the best option for most of your accounts.
Method 3: The sentence method
Turn a memorable sentence into a password using the first letters and numbers. For example, My first car was a blue 1998 Honda and I loved it! becomes Mfcwab1998H&Ili!. This works, but it is shorter and harder to type than a passphrase, so passphrases are usually better.
Comparing password methods
| Method | Example style | Strength | Easy to remember | Best for |
|---|---|---|---|---|
| Random passphrase | velvet-tractor-mango-orbit | Very strong | Yes | Master password, device logins |
| Random characters | t9#Vq2!mWz8@Lp4s | Very strong | No | Everything stored in a manager |
| Sentence method | Mfcwab1998H&Ili! | Strong | Medium | Occasional use |
| Word plus numbers | Sunshine2024! | Weak | Yes | Never |
| Personal info | Rex1990 | Very weak | Yes | Never |
The most common password mistakes
- Reusing passwords. When one site is breached, criminals try the same email and password on banks, email and shopping sites. This is called credential stuffing.
- Simple substitutions. Changing password to P@ssw0rd does not fool hacking tools, which test these substitutions automatically.
- Adding a number to the end. Summer2025 becoming Summer2026 is predictable.
- Using personal information. Names, birthdays, phone numbers and pet names can be found on social media.
- Keyboard patterns. qwerty, 1qaz2wsx and asdfgh are among the first guesses.
- Short passwords. Anything under 12 characters is much easier to crack.
- Sharing passwords by text or email. Messages can be intercepted or forwarded.
- Writing passwords on a sticky note on your screen. Anyone nearby can see them.
Use a password manager
Nobody can remember 100 unique strong passwords. A password manager solves this. You remember one strong master passphrase, and the manager creates, stores and fills in unique passwords for every site.
Popular options include Bitwarden, 1Password, Proton Pass, Dashlane, Apple Passwords and Google Password Manager. Many have free plans. Benefits include:
- Unique, random passwords for every account
- Automatic filling on websites and apps
- Alerts if a password appears in a data breach
- Protection against phishing, since managers will not fill passwords on fake domains
- Secure sharing with family members
For a deeper comparison, see our guide to the best password managers for 2027.
Frequently asked questions
How long should a password be?
At least 14 to 16 characters, or four to six random words for a passphrase.
Do I need symbols in my password?
Length and randomness matter more than symbols, but add them if a site requires it.
How often should I change my password?
Change it right away if a site is breached or you suspect someone knows it. Otherwise, regular forced changes are not necessary for strong, unique passwords.
Are passkeys better than passwords?
Yes. Passkeys use your device’s fingerprint, face or PIN and cannot be phished. Use them where available.
How long would it take to crack your password?
Cracking time depends on how the password is stored and how much computing power an attacker has, but the general pattern is clear:
| Password type | Example | Rough cracking difficulty |
|---|---|---|
| 6 lowercase letters | monkey | Instantly |
| 8 characters, mixed | Pa55word | Minutes to hours if common |
| Common word plus year | Football2026 | Seconds, it is in guess lists |
| 12 random characters | j7#Qw9!xL2@p | Centuries with current hardware |
| 4 random words | velvet-tractor-mango-orbit | Very long, far beyond practical |
| 6 random words | six unrelated words | Effectively uncrackable |
The key takeaway is that predictable passwords fall instantly regardless of length, while truly random passwords and passphrases become stronger with every character or word you add.
Turn on two-factor authentication
Even the strongest password can be stolen through phishing or a data breach. Two-factor authentication, also called 2FA or multi-factor authentication, adds a second step when you log in.
| 2FA method | Security level | Notes |
|---|---|---|
| Security key (hardware) | Highest | Physical key you plug in or tap |
| Passkey | Very high | Uses fingerprint, face or device PIN |
| Authenticator app | High | Apps like Google Authenticator or Microsoft Authenticator |
| Push notification | High | Approve sign in on your phone, but never approve unexpected requests |
| SMS code | Medium | Better than nothing, but vulnerable to SIM swaps |
Turn on 2FA first for your email account, because email is used to reset every other password. Then add it to banking, social media, cloud storage and shopping accounts.
What are passkeys?
Passkeys are the next step beyond passwords. Instead of typing a password, you sign in with your fingerprint, face or device PIN. Your device stores a secret key that never leaves it, so there is nothing for a fake website to steal. Google, Apple, Microsoft, Amazon, PayPal and many other services support passkeys. When a site offers to create a passkey, it is usually worth accepting, while keeping a strong password and recovery options as a backup.
How to check if your password was leaked
Use a breach checking service such as Have I Been Pwned to see whether your email appeared in known data breaches. Password managers and browsers like Chrome and Safari also warn you about leaked or reused passwords. If one of your passwords appears in a breach, change it immediately on every site where you used it.
How to remember your master password
- Choose a passphrase of five or six random words.
- Picture a silly scene with the words, such as a velvet tractor eating a mango in orbit.
- Type it daily for the first week to build muscle memory.
- Write it on paper and store it somewhere safe at home, not on your computer, until you are confident.
- Set up the password manager’s emergency access or recovery kit.
Password tips for families and businesses
- Use a family or business plan in your password manager to share accounts safely.
- Never share passwords over text, email or chat apps.
- Give each employee their own login instead of one shared password.
- Remove access when someone leaves.
- Teach children to use passphrases and never reuse school passwords on games or social apps.
Real examples
The reused password. Kevin used the same password for a small forum and his email. When the forum was breached, criminals logged into his email and reset his online shopping and bank passwords. After recovering, he moved everything into a password manager with unique passwords and turned on 2FA for his email.
The pet name. Sara’s password was her dog’s name plus her birth year. Both were visible on her public Instagram profile. Someone guessed it and took over her account. She switched to a five-word passphrase and enabled an authenticator app.
The upgrade. Dev replaced 60 weak passwords over one weekend using his password manager’s security report, starting with email, banking and work accounts. He now receives alerts whenever a saved password shows up in a breach.
Quick password checklist
- Every important account has a unique password
- Master and device passwords are random passphrases of at least four words
- A password manager stores everything else
- Two-factor authentication or passkeys are on for email, bank and social media
- No passwords contain names, birthdays or keyboard patterns
The bottom line
To create a strong password, make it long, unique and random. Use a passphrase of four to six random words for things you must remember, and let a password manager generate and store the rest. Turn on two-factor authentication everywhere. For more protection, read how to spot a fake website and how to recover a hacked Facebook account.