Passwords and password managers

What actually makes a password strong

Attackers do not guess passwords one by one by hand. They use leaked lists and software that tries billions of combinations, starting with the most common words, names, dates and patterns like Summer2026!. A password is strong when it is long, random and unique.

• Length matters most. Every extra character multiplies the work for an attacker. US guidance from NIST (Special Publication 800-63B) recommends allowing passwords of at least 64 characters and treats length as more important than forced complexity.
• Random beats clever. Swapping a for @ or adding 1! at the end is the first thing cracking tools try.
• Unique is non-negotiable. A strong password reused on ten sites is only as safe as the weakest of those ten sites.

NIST also advises organizations not to force regular password changes without a reason, and not to rely on composition rules, because they push people toward predictable patterns. Change a password when there is a sign it was exposed.

Passphrases for the few you must remember

You need to remember only a handful of passwords: your device login, your email, and the master password for your password manager. For those, use a passphrase of four to six random words, for example copper-lantern-orbit-pickle-meadow. Choose words randomly (dice-based "diceware" lists work well), not a song lyric or a famous quote.

Why you need a password manager

The average person has well over a hundred online accounts. Nobody can remember that many unique random passwords, which is why people reuse them. A password manager solves this: it generates a unique password for every site, stores them encrypted, and fills them in for you.

A good password manager also helps against phishing: it will not autofill your bank password on a look-alike site, because the address does not match. If your manager refuses to fill, stop and check the address.

Choosing one

• Built-in managers (Apple Passwords, Google Password Manager, Microsoft Edge) are free, simple and good enough for many people, especially if you stay within one ecosystem.
• Cross-platform managers such as Bitwarden (free tier, open source) or 1Password (paid) work across Windows, Mac, iPhone and Android.
• Offline managers such as KeePassXC store an encrypted file you control, for people who prefer no cloud sync.

A detailed comparison is in password managers compared.

Setting it up in one afternoon

1. Install the manager on your computer and phone, and the browser extension.
2. Create a strong master passphrase and write it down on paper kept somewhere safe at home until you have memorised it.
3. Turn on two-factor authentication for the password manager account itself.
4. Import passwords saved in your browser, then turn off the browser's own saving to avoid duplicates (unless the browser is your manager).
5. Start with the most important accounts: email, bank, phone carrier, cloud storage, social media. Change each to a generated password.
6. Run the manager's security report to find reused, weak or breached passwords, and fix a few each week.
7. Set up an emergency access or recovery option so a trusted person can reach your vault if something happens to you.

What about passkeys?

Passkeys are replacing passwords on many sites. They are stronger and cannot be phished. Most password managers now store passkeys too. See two-factor authentication and passkeys.