What Makes a Password Weak

Understanding what makes passwords easy to crack helps you avoid those patterns.

• Short passwords: anything under 12 characters is much easier to crack than longer ones.
• Common words and phrases: "password," "letmein," "welcome," and your name are among the first things hackers try.
• Personal information: your birthday, address, pet's name, or children's names are easy to guess from social media.
• Simple substitutions: replacing "a" with "@" or "e" with "3" is a well-known trick that hackers account for.
• Reusing passwords: if one account is breached, every account with the same password is compromised.

What Makes a Password Strong

A strong password has three qualities: it is long, it is random, and it is unique to each account.

• Length: at least 12 characters; 16 or more is better. Length matters more than complexity.
• Randomness: avoid predictable patterns. A random string is much harder to crack than a word with numbers added.
• Uniqueness: each account should have its own password. If one is compromised, the others remain safe.

Method 1: The Passphrase Approach

A passphrase is a string of four or more random words. It is long enough to be secure and much easier to remember than a random string of characters.

1. 1Pick four or more completely unrelated words — not a phrase you have heard before.
2. 2Example: "correct-horse-battery-staple" or "purple-lamp-ocean-Tuesday".
3. 3Add a number and a special character somewhere: "purple-lamp7-ocean-Tuesday!"
4. 4This password is 34 characters long, easy to remember, and extremely difficult to crack.

Method 2: The Sentence Method

Take a sentence you can remember and use the first letter of each word, plus numbers and symbols.

1. 1Think of a memorable sentence: "My dog Max turned 5 years old in July!"
2. 2Take the first letter of each word: MdMt5yoiJ!
3. 3This gives you a 10-character password with uppercase, lowercase, numbers, and symbols.
4. 4Make it longer by using more words in your sentence.

The Most Important Rule: Never Reuse Passwords

Even a strong password becomes a liability if you use it on multiple accounts. Here is why.

• Data breaches happen regularly. When a website is breached, the stolen passwords are tested against other sites automatically.
• If you use the same password for your email and your bank, and a small website you signed up for years ago is breached, your bank account is now at risk.
• Use a unique password for every account. A password manager (covered in a separate guide) makes this practical.

How to Store Passwords Safely

You cannot remember a unique strong password for every account — no one can. Here are your options.

• Password manager: an app that stores all your passwords securely and fills them in automatically. This is the recommended approach. See our guide on how to use a password manager.
• Your browser: Chrome, Safari, and Firefox all offer to save passwords. This is convenient but less secure than a dedicated password manager.
• Written list: writing passwords down is better than reusing weak ones, but keep the list in a secure location (not on your desk or taped to your monitor). Never store it digitally in a plain text file.

Enable Two-Factor Authentication

Even the strongest password can be stolen. Two-factor authentication (2FA) adds a second layer of protection — even if someone has your password, they cannot log in without also having your phone.

1. 1Go to the security settings of your important accounts (email, bank, social media).
2. 2Look for Two-Factor Authentication, Two-Step Verification, or 2FA.
3. 3Enable it and choose to receive a code by text message or through an authenticator app.
4. 4Each time you log in from a new device, you will need to enter both your password and the code.