What makes a strong password?

The details

Most account takeovers do not come from guessing a clever password; they come from reusing a password that leaked in another breach. That is why a unique password for every account matters more than any single rule about characters.

A password manager can generate and store long random passwords so you only need to remember one strong master passphrase.

What to do

• Use at least three or four random words, or a manager-generated password.
• Never reuse a password across accounts.
• Avoid personal details such as names, birthdays and pet names.
• Add multi-factor authentication on important accounts.

Terms explained

Credential stuffing

Credential stuffing is an automated attack that tries usernames and passwords leaked from one service against many other services, succeeding wherever people reused passwords.

Password manager

A password manager is an app that generates, stores and fills unique passwords and passkeys, protected by one strong master password and usually MFA.

Sources

• NIST SP 800-63B Digital Identity Guidelines
• NCSC: Top Tips for Staying Secure Online
• CISA: Secure Our World