What Makes a Strong Password (and Why a Passphrase Is Better)
Most "hacked" accounts aren't really hacked — the password was just easy to guess or reused somewhere that leaked. The good news: a strong password is simpler than you've been told. The trick isn't weird symbols — it's length. Great one to set up with the kids on their game accounts.
Steven's old password was his dog's name and a "1". He has four dogs, so he felt clever. He was not clever. — Nyx
Why it matters: attackers guess passwords by the millions per second, and they try leaked ones on every site. Two habits beat almost all of it: make them long, and never reuse them. This is the everyday version of how modern identity attacks work. Spot something wrong? Tell us.
Length beats complexity
A short password with symbols (P@ss1!) is weaker than four random everyday words strung together (copper-violin-sunset-batteries). Length is what makes guessing hopeless. A four-or-five-word passphrase is easy for you to remember and takes effectively forever to crack. Pick words that aren't a famous phrase — random is the point.
The two rules that matter most
- Make it long. Aim for a passphrase of 4–5 random words, or 16+ characters. Longer is stronger, every time.
- Never reuse it. One password per important account. When one site gets breached (and they do), attackers try that password everywhere else. Reuse is how one leak becomes ten break-ins.
You can't remember dozens — so don't
Nobody can memorise a different long passphrase for every account. The answer is a password manager: an app that generates and stores strong, unique passwords, locked behind one master passphrase you do memorise. You remember one; it remembers the rest. It also fills them in for you, which actually helps against phishing — it won't autofill on a fake look-alike site.
Ready to set one up? How to set up a password manager walks through it step by step.
Then add the second lock
Turn on two-factor (2FA / MFA) on your important accounts — email, bank, game accounts with money attached. It means that even if someone gets the password, they still need the second step. An authenticator app or a passkey is stronger than a text-message code, but any 2FA beats none.
The one-minute version
Long, not weird. Four random words beat P@ss1!. One password per account. Use a password manager so you only memorise one. Turn on 2FA on anything that matters. Do those four and you're ahead of most adults.
Length, no reuse, a manager, 2FA. That's it. Even Steven managed it — eventually. — Nyx
Want the next step? Some sites now let you skip passwords entirely with passkeys. Start with the four habits above, though — they cover everything. — Nova