Last updated:
Length matters most
Each extra character multiplies the number of guesses an attacker needs. A random 16-character password is far harder to crack than an 8-character one, even if the shorter one uses symbols.
If a site allows it, use 16 characters or more for important accounts such as email, banking and business tools.
Random beats clever
Swapping letters for numbers (p@ssw0rd) or adding a year to a word is predictable, and cracking tools try those patterns first.
A generator that uses secure randomness avoids human patterns completely.
Never reuse passwords
When one website is breached, attackers try the same email and password on other sites. A unique password for every account stops one leak from becoming many.
Use a password manager
Nobody can remember dozens of random passwords. A password manager stores them encrypted and fills them in for you, so you only need to remember one strong master password.
Turn on two-factor authentication wherever it is offered for an extra layer of protection.