Strong Passwords and Password Managers: A Practical Guide

Creating strong passwords is one of the cheapest and most effective ways to protect your accounts. Yet most of us still reuse the same few passwords across dozens of sites. This guide explains what a good password looks like, why every account needs a different one, and how a password manager takes the burden off your memory.

What makes a password strong?

A strong password is hard to guess, used nowhere else, and never shared. The single most important factor is not complexity but length. A password like "P@ssw0rd!" looks complicated, but it is short and follows patterns everyone knows. A long phrase made of unrelated words is both safer and easier to remember.

A practical rule of thumb:

• Make it long. Aim for at least 14-16 characters, and go longer for important accounts.
• Make it random. Avoid birthdays, pet names, team names, or phone numbers: anything people close to you could guess.
• Make it unique. Every account gets a password completely different from the others.
• Avoid predictable tricks. Adding "1" at the end, swapping letters for digits, or using sequences like "123456" fools no one.

The passphrase method

For the few passwords you must memorize (for example your password manager's master password and your email), a passphrase of four or five random words works well. Pick the words truly at random, not from a poem or song. Use dice or a generator built into a password manager if you can. Adding a separator and a digit or two is enough.

Why you should not reuse passwords

The biggest password risk is not weakness but reuse. When a service suffers a data breach, leaked email and password pairs are tried on other sites. If you reused one password in several places, a single leak puts them all at risk. So your social media, email, banking, and shopping accounts should each have their own.

Your email account is the most critical one, because most services send their "forgot my password" link there. Someone who gains access to your email can often find a way into your other accounts. Give your email a unique, long password and turn on two-step verification.

What is a password manager and why does it help?

A password manager stores all your passwords in an encrypted vault and fills them in when needed. You remember one strong master password and the vault handles the rest. Here is what you get:

1. Unique password generation. It creates a long, random password for each account, so you never have to remember it.
2. Autofill. It fills passwords only on the correct address, which also acts as a warning against fake login pages. If the manager does not offer to fill, treat that as a red flag.
3. Syncing. You reach the same vault on your phone, tablet, and computer.
4. Weak and reused password reports. Many managers flag passwords that are weak, old, or duplicated.
5. Secure notes. Recovery codes, private notes, and card details can live in the same vault.

Which type should you choose?

| Option | Pros | Things to watch |
|---|---|---|
| Built-in browser manager | No extra setup, easy to use | Depends heavily on device and account security; moving data between browsers may be limited |
| Standalone password manager | Works across platforms, offers extra features | You must not forget the master password and should set up recovery options |
| Offline (local) vault | Data stays only on your device | Backups and syncing are your responsibility |

Whichever you pick, check that the product is updated regularly and explains how it handles encryption.

Switching to a password manager step by step

You do not have to change every password in a day. Try this order:

1. Choose a password manager and set a long, unique master password. Never use it for anything else.
2. Write down the recovery information (a recovery key or code) on paper and keep it somewhere safe. If you forget the master password, most managers cannot rescue you.
3. Turn on two-step verification for the manager itself. To compare options, see our article on two-step verification methods.
4. Replace passwords with generated ones, starting with email, then banking, social media, and shopping.
5. Work through older accounts gradually. Deleting accounts you no longer use also shrinks your exposure.

Common mistakes

• Keeping passwords in browser notes, phone notes, or a plain text file. If the device is compromised, everything is exposed.
• Emailing or messaging passwords to yourself. Those messages can sit in an archive for years.
• Changing a password by only adding a digit at the end.
• Using dictionary passwords made of single words.
• Giving real answers to security questions. Details like your mother's maiden name can often be found on social media. Use random answers stored in your vault instead.
• Saving passwords on a shared device. Do not use "remember me" on public computers.

A password alone is not enough

Even the best password can leak one day. That is why you should add a second layer: two-step verification. An SMS code is better than nothing, but an authenticator app or a security key is more resilient. Passkeys, which allow password-free sign-in, are also becoming more common.

If you are signing up for a service just to try it, or for a one-time registration, you do not have to hand over your real phone number. A virtual number lets you receive the verification code without sharing your own number. Keep in mind that virtual numbers are single-use, so if you plan to keep the account, add a password manager, a recovery email, and two-step verification. Some platforms may restrict virtual numbers, and you should always follow each platform's terms of use. You can see current options on our pricing page.

Frequently asked questions

Isn't a password manager a single point of failure?

It is a fair concern. That is why you should keep the master password long, turn on two-step verification, and store recovery information offline. It is usually far safer than relying on reused, weak passwords.

How often should I change my passwords?

You do not need to rotate every password on a schedule. A strong, unique password does not have to change unless you suspect a leak. Change it right away if a service reports a breach or you notice unusual activity.

Is writing passwords in a notebook safe?

A paper notebook locked away at home is out of reach for most online attacks, but it can be lost. Keeping a few critical items on paper, like the master password and recovery key, is reasonable. Keeping all your passwords there is impractical.

Is saving passwords in the browser enough?

It beats not saving them at all, but it depends on your device and browser account security. Set a screen lock and enable two-step verification on the account. If you want more features, consider a standalone manager.