How to Create a Strong Password: Password Security Guide

How passwords are exposed

A password can be stolen through a fake sign-in page, malware, an insecure device or a breach at the service that stores it. Attackers also try common passwords and details that are easy to discover, such as names, birthdays, football teams and predictable keyboard patterns.

Reusing one password magnifies the damage. If a breached website exposes it, automated attacks can try the same email address and password on shopping, social-media and email accounts. This is why uniqueness is at least as important as making a password look complicated.

No password is invulnerable, and a legitimate-looking message can still be phishing. Password security works best as several layers: a strong unique credential, careful sign-in habits, current software and a second verification step.

Create a long, hard-to-guess password

Length gives a password more possible combinations, but length only helps when the content is not predictable. Adding “1!” to a familiar word does not turn it into a strong secret. Avoid quotations, repeated patterns, personal information and obvious substitutions such as changing an “o” to a zero.

For an account whose password must be remembered, the UK National Cyber Security Centre recommends combining three random words. The words should be unrelated and not based on information visible on social media. Do not copy the examples in a guide; choose your own random combination.

Where a service has its own minimum length or character rules, follow them. A password manager can produce a longer random value without relying on memory. Never type a real password into an online strength checker or share it with a generator that you do not trust.

Use a different password for every account

Every important account should have a password that is not used anywhere else. Start with email, banking, cloud storage and social media, because access to these can expose private information or help an attacker take over other services.

If you currently reuse passwords, you do not have to repair everything at once. Change the email account first, then financial accounts and services that store payment details. Continue with accounts containing personal documents or messages. Each unique password removes one link from the reuse chain.

Do not create a predictable family of passwords such as the same base word followed by the website name. Someone who discovers one pattern may be able to infer the rest.

Use a reputable password manager

A password manager stores credentials in an encrypted vault and can generate a different random password for each account. It reduces the temptation to reuse memorable passwords and can fill credentials only on the expected website, which may also help reveal a fake domain.

Choose a maintained product from a reputable provider, install updates promptly and secure the vault with a strong master password that is used nowhere else. Turn on two-step verification for the manager when it is available. Keep the provider’s recovery information in a secure place.

Browser password storage may be convenient, especially on a well-protected personal device. Whichever method you choose, lock the device, keep its operating system current and do not leave an unlocked vault on a shared computer.

Give your email account extra protection

Email is commonly used to reset passwords for other services. Someone who controls it may be able to read private information, impersonate you and request account-recovery links. The NCSC therefore advises using a strong and separate email password.

Review the recovery phone number and backup email attached to the account. Remove addresses or devices you no longer control. Check recent sign-in activity when the provider offers it, and treat unexpected password-reset messages as a warning rather than clicking immediately.

Turn on two-step verification

Two-step verification—also called 2SV, two-factor authentication or MFA—requires another check in addition to the password. Depending on the service, that may be an authenticator-app code, security key, passkey, approval prompt or text message.

Use the strongest option the service offers and that you can recover reliably. Save backup codes somewhere secure and add a second recovery method if permitted. Never read a one-time code to someone who contacts you unexpectedly; a genuine support agent should not need it to “protect” your account.

What to do if a password may be compromised

1. Go directly to the real website or app rather than using a link in the warning message.
2. Change the affected password to a new unique one.
3. Change it anywhere else it was reused.
4. Sign out other sessions and review recovery details.
5. Turn on two-step verification.
6. Check account activity, sent messages and payment details for unfamiliar changes.
7. Update the device and scan it if malware is suspected.

For current UK advice, consult the National Cyber Security Centre’s staying-secure guidance. UsefulFox provides general educational information, not incident-response or professional security services.

What about passkeys?

Passkeys are increasingly available as an alternative to passwords. The NCSC recommends choosing a passkey where a service offers one because it is designed to resist common password threats such as phishing. If an account still has a password as a fallback, keep that password strong and unique and continue to use two-step verification where appropriate.

Explore password security in more detail

Learn more about password length, compare a passphrase vs password, understand password strength and entropy, or see how secure random password generators work.

Frequently asked questions