How to create a strong password

The short version: long, unique, and saved in a password manager.

Last reviewed October 18, 2026 · See the sources · Download this guide (PDF)

Think someone has your password right now? Change it on that account first, then on any other account where you used the same password. Then turn on two-step verification. If someone may have had remote access to your computer, follow those steps first and change your passwords from a different device you trust.

What makes a password strong

Long. At least 16 characters. Longer is stronger. Length matters more than anything else.
Random. Use either a random mix of letters, numbers, and symbols, or a passphrase: four or more random, unrelated words, like lantern-marble-orbit-cactus. (Don't use that one. It's on the internet now.)
Unique. Use a different password for every account. If one site leaks your password, the others stay safe.

Why: criminals try leaked passwords on other sites automatically. A long, unique password stops one leak from turning into many break-ins.

What matters less than you think

Swapping letters for symbols (like P@ssw0rd) doesn't make a short password strong. Length does far more.
Changing a strong password on a schedule isn't necessary. Change it when it may have been exposed, such as after a data breach, a scam, or if you shared it.

U.S. government password guidance (NIST) tells websites not to force mixes of character types or regular password changes, and to let you use a password manager.

Let a password manager do the work

Nobody can remember dozens of long, random passwords, and you shouldn't try. A password manager is an app that:

creates strong passwords for you,
remembers them, and fills them in when you sign in, and
warns you about passwords that are weak or used more than once.

Your phone or web browser may already include one (which one is right for you?). Whichever you choose, protect it with a strong passphrase and turn on two-step verification for it.

Start small: give your email and your bank their own new, strong passwords today. Do the rest over time.

Even better: passkeys

Some accounts let you sign in with a passkey instead of a password. A passkey uses your phone or computer's screen lock (your face, fingerprint, or PIN) to sign you in. There's nothing to type, so there's nothing to steal or trick you into giving away. If an account offers a passkey, it's worth turning on. What are passkeys? →

Official how-tos: About passkeys (Apple) · Sign in with a passkey (Google)

Next step

A strong password is the first lock. Two-step verification is the second, and it protects you even if a password leaks.

Sources

Checked on October 18, 2026. Next review: by October 2027.

Use Strong Passwords (CISA)
Digital Identity Guidelines: Authentication, SP 800-63B-4 (NIST)
About the security of passkeys (Apple) · Sign in with a passkey instead of a password (Google)

From beaponi.com/learn/strong-passwords · Last reviewed October 18, 2026 · General education, not professional advice.