What makes a password strong?
Length and randomness matter far more than clever symbols. Current guidance from NIST recommends long passwords or passphrases, no forced complexity rules, no forced regular changes and checking choices against lists of breached passwords. A 20-character random password is stronger than a 10-character one packed with symbols, and a five-word random passphrase is both strong and memorable.
Which mode should I use?
- Random password: best for anything stored in a password manager.
- Passphrase: best for the few secrets you must remember, such as your device login and password manager master password.
- Easy to say: useful when you must read a password aloud.
- PIN: for numeric codes. Use at least 6 digits and enable lockouts on the device.
Good habits
- Use a unique password for every account.
- Store them in a password manager rather than a spreadsheet.
- Turn on multi-factor authentication, and passkeys where offered.
- Change a password when there is a sign of a breach, not on a calendar schedule.
Read the full guide: how to create strong passwords and use a password manager.