Length is the most important factor
Every extra character multiplies the number of combinations an attacker must try. A 16-character random password is vastly stronger than an 8-character one, even if the shorter one has symbols. Current guidance from organizations such as NIST emphasizes length and uniqueness over complex rules.
Use a unique password for every account
The biggest real-world risk is password reuse. When one website is breached, criminals try the same email and password on other sites, an attack called credential stuffing. A unique password for each account stops one leak from becoming many.
Passphrases
A passphrase of four or more random, unrelated words, such as "copper-violin-harbor-mango", is long, hard to guess and easier to remember than random characters. The words must be truly random, not a quote or song lyric.
Use a password manager
Remembering dozens of unique passwords is impossible, so use a reputable password manager. It generates and stores strong passwords, fills them in automatically and warns you about reused or breached passwords. You only need to remember one strong master passphrase. Our password generator creates random passwords locally in your browser.
Turn on two-factor authentication
Two-factor authentication (2FA) adds a second step, such as an authenticator app code or a hardware key. Even if your password is stolen, an attacker can't log in without the second factor. Authenticator apps and security keys are safer than SMS codes.
Passkeys
Many services now support passkeys, which replace passwords with a cryptographic key stored on your device and unlocked by your fingerprint, face or PIN. Passkeys can't be phished or reused, so enable them wherever they are offered.
Avoid common mistakes
Don't use names, birthdays, pet names or keyboard patterns like "qwerty". Don't share passwords by text or email. Be wary of messages asking you to "verify" your login; go to the website directly instead of clicking links.
Check for breaches
Breach-notification services let you see whether your email appeared in known leaks. Change any affected password immediately.
Frequently asked questions
How long should a password be in 2026?
At least 12–16 characters; longer is better.
Are passphrases secure?
Yes, if they use four or more truly random words.
Should I use a password manager?
Yes; it lets you use a unique strong password for every account.
What is a passkey?
A phishing-resistant login method that uses a cryptographic key on your device instead of a password.