How to Create Strong Passwords: A Safer, Memorable System

The safest practical system is to let a reputable password manager generate and store a different long, random password for every account.[20] Memorize one strong passphrase for the manager, protect the manager and your email with strong multifactor authentication, and replace exposed or reused passwords promptly.[20][21]

Last verified: August 22, 2026.

The three properties that matter

Long

Current FTC consumer advice says to aim for at least 12 characters, while CISA’s archived Secure Our World page says at least 16.[20][10] NIST’s current requirements are written for organizations that verify passwords: a password used as the only authentication factor must have a minimum of 15 characters, while an eight-character minimum is permitted when the password is used as part of multifactor authentication.[8]

Those numbers serve different audiences. A simple household rule is: use a password manager’s long generated password and follow any longer requirement imposed by the service.

Random

Human transformations such as replacing a with @, adding the year, tracing keyboard shapes, or taking initials from a personal sentence are predictable.[9] Current FTC guidance recommends a reputable password manager or browser generator because people are not good at generating randomness.[20]

Unique

Every account needs a different password.[20] Reuse allows attackers to try a credential exposed by one service against other accounts.[20] Adding a site name to a shared base password does not make the results independently unique.[9]

The recommended workflow

1. Choose a password manager

Compare reputable products using current independent reviews and official documentation. Check:

support for every device and browser you use;
how account recovery works;
whether you can protect the vault with strong MFA;
export and backup options;
security notices and update history; and
whether family or emergency access is important to you.

A password manager can generate, store, and fill unique passwords.[20] Specific features vary, so verify them before choosing.

2. Create one memorized master passphrase

Use a long passphrase made from unrelated words selected unpredictably—not a quotation, lyric, personal story, pet name, address, birthday, or published example.[20] CISA’s archived page describes four to seven unrelated words; the current FTC page emphasizes random words without prescribing a universal count.[10][20]

Do not copy any example from an article.[9] Once a password appears publicly, it is not a secret.[9]

Your master passphrase should be:

used only for the password manager;
long enough to meet or exceed the manager’s requirements;
unrelated to facts other people can discover; and
stored in a secure recovery location if losing it would permanently lock you out.

3. Generate a different password for every account

Use the manager’s generator rather than a reusable formula.[20] As a conservative practical default, this guide recommends at least 16 characters when the service permits it. That is an editorial recommendation, not a universal NIST or FTC requirement.

Do not weaken a generated password to make it memorable. The manager is meant to remember it.[20]

4. Protect the vault and your email with MFA

A password alone is not phishing-resistant.[8] Enable the strongest MFA each important service supports, especially for your password manager and primary email.[21] CISA’s implementation fact sheet identifies FIDO/WebAuthn as the only widely available phishing-resistant authentication; its Secure Our World consumer MFA page is archived.[26][11]

A security key is preferable to a text-message code when the service supports it.[21] A supported passkey can also provide phishing-resistant public-key authentication, but passkey storage, synchronization, and recovery vary by service and device.[26][27] Any MFA is still better than password-only protection for most accounts, but recovery methods also need protection.[21]

5. Replace the riskiest passwords first

Prioritize:

your primary email;
your password manager;
financial and payment accounts;
cloud storage;
social media and messaging;
shopping accounts that store payment details; and
every account that reuses an exposed password.

You do not need to finish in one session. Change a few accounts at a time and verify that autofill works before moving on.

What not to use

A shared base plus the service name

SharedBase-Amazon and SharedBase-Bank reveal the rule if either password is exposed.[9] Use independent generated passwords instead.[20]

Personal stories or acrostics

Initials from a sentence about a car, school, family member, year, or vacation are not reliably random.[9] Personal facts can also be discovered or guessed.[20]

Keyboard patterns

Lines, shapes, and familiar key sequences are included in password-guessing strategies.[9] They feel private but are not a sound generation method.[9]

Routine symbol substitutions

P@ssw0rd! remains predictable. Composition alone does not rescue a common word or pattern. NIST specifically warns that composition rules lead users toward predictable changes.[9]

Published examples

Never copy a password from this or any other guide.[9] Examples are known values.[9]

Crack-time charts without an attack model

A universal “time to crack” is misleading.[9] The result depends on how the password was generated, whether an attack is online or offline, rate limits, the service’s password hashing, hardware, and whether the value is already in an attacker’s list.[9] Use safe generation practices instead of relying on a dramatic estimate.[9]

When should you change a password?

Change it when:

a service says it was exposed;
you entered it into a suspected phishing page;
someone else learned it;
malware or unauthorized access may have exposed it;
you reused it elsewhere; or
it is weak and you are moving it into your manager.

NIST says verifiers should not require periodic changes without evidence of compromise and should force a change when compromise is known.[8] That does not mean keeping a weak or reused password indefinitely.

What if a site has bad password limits?

Use the longest randomly generated value the site accepts. Do not replace it with a memorable pattern merely because the limit is short. Turn on MFA, keep the account’s recovery email secure, and consider reporting the restrictive limit to the service.

Is it safe to write down a master passphrase?

A paper recovery copy stored in a physically secure location may be a reasonable recovery option. This is threat-model-dependent editorial advice, not a NIST, FTC, or CISA requirement. Consider who has access to your home or office, and do not leave the copy on a monitor or carry it with the device it unlocks.

Should you use an online password-strength checker?

Do not paste a real password into an arbitrary strength-checking website. That is a conservative editorial safety rule. A checker cannot prove that a password is safe, and a structurally similar example does not establish the unpredictability of the real password.[9] Prefer your password manager’s local audit or a documented privacy-preserving breached-password check. Pwned Passwords warns that “not found” does not mean a password is good.[28]

What to do after suspected exposure

Go to the service through a trusted bookmark or app—not a link in the warning message.
Change the password to a new generated value.
Sign out other sessions where the service permits it.
Review recovery email, phone, MFA methods, forwarding rules, and recent activity.
Change every account that reused the old password.
Run security updates and investigate the device if malware is possible.
Watch for follow-up phishing.

Frequently asked questions

How long should my password be?

Current FTC consumer advice says to aim for at least 12 characters; CISA’s archived Secure Our World page says 16 or more.[20][10] NIST’s 15-character single-factor minimum is a requirement for verifiers, not a universal instruction that every consumer should stop at 15.[8] Generated passwords can be longer when the service accepts them.

Are several unrelated words safe?

A long passphrase of unpredictably selected unrelated words can be appropriate for the one secret you must memorize.[20] Do not choose a familiar phrase or words connected to your life, and do not reuse it.[20] For ordinary accounts, use manager-generated random passwords instead.[20]

Are password managers perfectly safe?

No security product is risk-free. A manager concentrates valuable credentials, which is why the master passphrase, MFA, updates, recovery process, and vendor track record matter. For most people, it is a practical way to avoid widespread reuse and weak human-created passwords.[20]

Should I use biometrics instead of a password?

A fingerprint or face scan can verify the user locally to unlock a device or activate a passkey, depending on the system; it is not sent to the website as a reusable password.[27] NIST does not treat a biometric characteristic as an authenticator by itself.[8] Follow the device or service’s recovery guidance and secure the underlying account.

What is the most important account to fix first?

Your primary email, because it often controls password resets for other services. Protect it with a unique generated password and the strongest MFA it supports.