Strong password tips that actually matter
Password advice has changed. Length and not reusing passwords matter far more than cramming in symbols.
- Make them long. A passphrase of several random words is both stronger and easier to remember than a short, cryptic password.
- Never reuse passwords. If one site is breached, attackers try that password everywhere. Unique passwords stop that.
- Use a password manager. It creates and remembers a unique strong password for every account, so you only remember one master password.
- Turn on two-step verification (2FA) for important accounts — email, banking, and anything with payment details. It blocks most account takeovers even if a password leaks.
- Protect your email most of all. Your email can reset other accounts, so give it your strongest password and 2FA.
You do not need to change passwords constantly. Change a password when a service reports a breach, or if you suspect it was exposed — and never reuse it.
Frequently asked questions
Are password managers safe?
Reputable password managers encrypt your data so only you can unlock it. The risk of reusing weak passwords is far greater than the risk of a well-reviewed manager.
Do I need to change my passwords every month?
No. Modern guidance is to use long, unique passwords with 2FA and change them only when there is a reason, such as a breach.