Most break-ins do not need clever hacking. They use passwords that are short, common or reused from another site that was leaked. Three habits stop most of this: long passwords, a different one per account, and a password manager to remember them.
Length beats symbols
Each extra character multiplies the number of guesses an attacker needs. A random 12-character password is far stronger than an 8-character one full of symbols, and a 16-character one is stronger still. Replacing letters with look-alike symbols, such as P@ssw0rd, adds almost nothing, because attackers try those swaps first.
What makes a password weak
- Names, birthdays, phone numbers or your pet’s name.
- Common words and patterns:
password,123456,qwerty,iloveyou. - The same password on several sites. One leak then opens them all.
- A small change on a theme, like
Summer2025thenSummer2026.
Passphrases you can remember
For the few passwords you must remember, such as your phone lock and your password manager, use a passphrase: four or five unrelated words, like copper-lantern-orbit-mango. It is long, easy to type and easy to recall, and random words matter: a famous quote is guessable.
Use a password manager
A manager creates a unique random password for every site and fills it in for you. You remember one strong passphrase and the manager does the rest. Browsers’ built-in managers are better than reusing passwords, and dedicated managers add sharing and checks.
Turn on two-factor login
A second step, such as a code from an authenticator app or a security key, means a stolen password is not enough. Turn it on first for email, banking and anything that can reset other accounts. App-based codes are safer than SMS codes where you have the choice.
What to do after a leak
- Change the password on that site, and on every other site where you used it.
- Turn on two-factor login.
- Check your email for unexpected forwarding rules or sign-ins.
- Be careful with messages that mention your leaked details; they are often scams.
Hashes are different from passwords. A hash is a fixed fingerprint of data, used to check that a file or password is unchanged; see the Hash Generator. Sites should store only salted hashes of passwords, never the passwords.
Frequently asked questions
Is it safe to use an online password generator?
Yes if it creates the password in your browser and sends nothing. This one does, using the browser’s secure random generator, and it works offline once loaded.
How often should I change passwords?
You do not need to change a strong, unique password on a schedule. Change it when a site is breached or you suspect someone else knows it.