Quick answerA strong password is long (at least 14 characters), unique to one account, and not based on personal details. The easiest method is a passphrase of four or more random words for passwords you must type, and a password manager such as Bitwarden, 1Password or your browser's built-in manager to generate and store unique passwords for everything else.
Most accounts aren't hacked by someone guessing your password. They're opened with a password leaked from a different site you also used it on. That's why uniqueness matters more than clever symbols.
What makes a password strong
- Length: 14+ characters. Every extra character multiplies the work for an attacker.
- Uniqueness: one password per account, so a breach of one site doesn't unlock the others.
- Unpredictability: no names, birthdays, phone numbers, cricket teams or "Pakistan@123".
Passphrases for the passwords you type
Pick four or more random, unrelated words: "chai-window-river-planet". It's long, easy to type and far harder to crack than "P@ssw0rd!". Use this approach for your phone, computer and password-manager master password.
A password manager for everything else
A password manager creates a random password for each site, saves it in an encrypted vault and fills it in for you. You remember one master passphrase. Good options include Bitwarden (free and open-source), 1Password, and the managers built into Google Chrome, Android and iPhone.
Check what's already leaked
Use Drofsecurity's password checker to see whether a password appears in known breaches. It never sends your password: only the first five characters of its hash leave your device. Any password that appears should be retired everywhere.
Frequently asked questions
How long should a password be in 2026?
At least 14 characters for important accounts. A four-word passphrase easily meets this.
Are password managers safe?
Reputable managers encrypt your vault with your master password, so the company can't read it. They're far safer than reusing passwords. Protect the manager with a strong passphrase and two-factor authentication.
Should I change my passwords regularly?
Only when there's a reason, such as a breach. Frequent forced changes lead to weaker, predictable passwords.