How to create strong passwords and actually manage them

In the article on how to check if your password was leaked we looked at what happens when a password ends up on a stolen list and how to check one without handing it over. This is the other half: how to create passwords that hold up and, above all, how to manage them without relying on memory.

The good news is that current advice is simpler than it was a few years ago: fewer odd rules and fewer forced changes.

Why length beats symbols

Someone trying to guess a password does not try things at random: they start with what people usually do. Summer2024! meets the rules of a typical sign-up form (a capital, a number, a symbol) and is among the first things an attack tool tries, because it follows a well-known pattern.

What really makes the job harder is length: every extra character multiplies the possible combinations, far more than a symbol adds to a short password.

Hence the idea of the passphrase: several unrelated words, such as tortoise lamp market cloudy plum. Five words picked at random from a list of 7,776 (the one used by the dice method the EFF publishes) give more combinations than eight completely random characters drawn from every symbol on the keyboard, and they are far easier to remember and type.

The one condition is that the words are genuinely random: a proverb, a song lyric or the name of your football team are on attackers’ lists too.

Why every service needs its own password

Because you have no control over how each service stores your password. If one of them suffers a breach, whoever holds that password will try it on all the others. A different password for each site turns a breach into a problem for one account only. The obstacle is obvious: nobody can remember fifty long, different passwords. And nobody needs to.

Password managers and how to choose one

A password manager keeps your passwords in an encrypted vault, generates long random ones and fills them in for you when you sign in. You only remember one: the one that opens the vault.

It also only fills in the password on the right domain. If a fake email takes you to a copy of your bank’s login page, the manager does not recognise the address and offers nothing.

The manager built into your browser or operating system (Chrome’s, Edge’s, Safari’s or Apple’s Passwords app) is enough if you always stay within the same ecosystem. Independent ones, such as Bitwarden or 1Password, work across any browser and system and add shared vaults for teams. When choosing, look for:

• Support for all your devices, phone included.
• End-to-end encryption: the provider stores the vault but cannot read it.
• Two-step verification to open the account, and an export option in case you ever switch.
• Warnings about reused, weak or leaked passwords.

The master password

It is the one password that still depends on you, so it deserves your most carefully chosen passphrase, used nowhere else. Keep the recovery code on paper, somewhere safe: in a well-designed manager nobody can recover it for you, and that is precisely what makes it secure.

Which two-step verification to choose

Two-step verification (2FA) asks for something beyond the password to get in. Not every method offers the same protection against phishing, one of the most common ways accounts are stolen.

Method	What it is	Against phishing
Security key or passkey	A device or a credential tied to the site	Resists it: does not work on a fake domain
Authenticator app	Six-digit codes that change every 30 seconds	Better than SMS, but the code can be typed into a fake site
SMS	A code sent to your phone by text message	The weakest: it can be intercepted or diverted by SIM swapping

Even so, any second step is far better than none: if a service only offers SMS, turn it on anyway, and keep the recovery codes it gives you when you set it up.

What a passkey is, in plain terms

A passkey replaces the password with a pair of digital keys. One stays on your device and never leaves it; the other is held by the service. When you sign in, your device asks for your fingerprint, face or PIN and proves it holds the right key without sending it.

• There is nothing to remember and nothing to leak. If the service suffers a data breach, what is taken cannot be used to log in.
• It is tied to the domain. A fake site cannot ask for the real site’s passkey, so classic phishing stops working.
• It syncs across your devices through the operating system (Apple, Google, Microsoft) or your password manager.

Not every service offers passkeys yet, but wherever they are available, especially for email, they are worth turning on.

Passwords in a business

In a small business, access tends to grow without any order: the hosting password in an old chat, the social media one in a spreadsheet, an admin account shared by half the team. A few rules sort it out:

• No passwords over chat or email. Those messages stay around forever.
• One account per person wherever the service allows it. That way you can remove one person’s access without changing everyone else’s.
• A shared vault for whatever does not support individual accounts, with each person seeing only what they need.
• Remove access the same day someone leaves, and change the shared passwords they knew.
• Company recovery addresses, not personal ones. If the domain is recovered through a former contractor’s Gmail, the real control is theirs.

Myths worth dropping

“Passwords must be changed every 90 days.” The US NIST digital identity guidelines (SP 800-63B) advise against forcing periodic changes unless there is evidence of compromise. The reason is practical: people forced to change it end up going from Summer2024! to Autumn2024!, which protects nothing. Change it when there is a reason: a breach, suspicious access, someone leaving the team.

“It must include a capital, a number and a symbol.” The same guidelines recommend against arbitrary composition rules, call for allowing long passwords (at least 64 characters) and, instead, rejecting those that already appear on lists of common or leaked passwords.

“Security questions keep me safe.” Your first pet’s name or your birthplace can be found on social media, and NIST advises against these questions too. If a service insists, answer with a random phrase and store it in your manager.

Checking a password before you use it

Before you settle on a master password, or decide to keep one you already use, it is worth making sure it is not already in circulation. Our pwned password checker tells you whether a password appears in the breaches collected by Have I Been Pwned and how many times, without the password leaving your browser. It also shows its length and which kinds of characters it contains, and flags it when it falls below 12 characters.

If it appears, discard it however original it seems. If it does not, length is still what decides.

---

There is no need to do it all at once. Start with your email: a new passphrase, two-step verification and, if you can, a passkey. Then install a manager and change the rest as you sign in to each service.