Learn about password security

Passwords are still one of the most common ways we protect our accounts. But creating a secure password is not really about making it look complicated.

It is about making it long, unpredictable, unique, and difficult to guess.

This guide explains the basics of password security in simple terms—from how password strength works to how attackers try to get around it, and what you can do to protect yourself.

What makes a password strong?

Strong passwords share a few important qualities. Each one makes guessing or reusing a password harder.

Long

A longer password generally gives an attacker a larger search space.

T7!qP2#xriver-lamp-cactus-moon

The second example is much longer. Aim for at least 12 characters when you create a password yourself; longer is generally better.

Unpredictable

Complicated-looking does not automatically mean unpredictable.

P@ssw0rd123! uses common substitutions and a familiar pattern. Keyboard sequences, names, dates, and favorite teams are predictable too.

Unique

Do not reuse a password across important accounts. If one service is breached, attackers may try the same username and password everywhere else.

Not compromised

A password that has appeared in a breach should not be reused. Even a strong-looking password is no longer a good secret once it is known to attackers.

The goal isn't to make a password look complicated.
The goal is to make it difficult to guess.

Length, randomness, and entropy

Entropy is a way to describe how many possibilities an attacker would need to search. More random possibilities usually means a larger search space.

Adding length can increase the number of possible combinations very quickly. For example:

10 × 10 × 10 × 10 = 10,00010⁸ = 100,000,000

Entropy does not automatically tell us the true strength of a human-created password. Humans are predictable, so Summer2026! may look complicated but still follows a pattern.

Entropy is particularly useful when discussing random password generation.

Think of entropy as a useful concept—not a magic score.

But entropy has a catch

Entropy assumes choices are equally likely. A word you chose because it felt random is not as random as a word selected by a secure generator.

That distinction is why generated passwords and passphrases can be useful: the selection process does not rely on familiar human patterns.

Passwords vs. passphrases

A passphrase is a password made from multiple words. Both formats can be strong when the choices are random, long enough, and unique.

Password

Random characters can be very strong and are good for generated credentials.

T7!qP2#x9Lm$

Passphrase

Multiple words can be easier to remember, but should use randomly selected words.

river-lamp-cactus-moon

river-lamp-cactus-moon is a random passphrase. IloveMyDogAndCoffee is long, but it is based on a familiar sentence and is not automatically strong simply because it has many characters.

Long + random + unique is the goal.

Create a secure password Create a passphrase

Password habits that actually matter

Good password habits are practical habits. They reduce the number of ways a password can be guessed, reused, or lost.

1. Make passwords long

Give your password enough length to make guessing difficult.

2. Make them unique

Don't use the same password across important accounts.

3. Don't use predictable information

Avoid names, birthdays, cities, favorite teams, common words, and information connected to you.

4. Don't rely on “tricks”

Changing password into P@ssw0rd! doesn't magically make it unpredictable.

5. Don't change passwords just because the calendar says so

If a password is strong, unique, and hasn't been compromised, repeatedly changing it can create unnecessary password-management problems. Change it when there is a reason, especially if it has been exposed.

6. Don't depend on memory for everything

You don't need to memorize dozens or hundreds of unique passwords. That's what password managers are for.

Password managers

A password manager helps you use a different, strong password for every account without asking you to memorize them all.

One strong master credential

Password vault

Unique passwords for every account

Generate long random passwords

Give every account a unique password

Store passwords securely

Autofill credentials

Reduce password reuse

Manage passkeys

In some cases, manage one-time codes

Alert you about compromised credentials

One important rule

Don't put your password manager's only recovery key inside the password manager. Store recovery information securely and keep it accessible when needed.

How attackers get passwords

Attackers use many approaches. Understanding them makes it easier to spot weak habits and suspicious requests.

Credential stuffing

Attackers may take a username/password combination from one breach and try it on other services.

One leaked password can become many compromised accounts.

Password spraying

Instead of trying many passwords against one account, attackers try a small number of common passwords against many accounts.

Data breaches

Services can be breached and password data can be stolen. Good services store passwords using hashing, but exposed credentials should still be considered compromised.

Phishing

Fake emails, messages, login pages, QR codes, and phone calls can trick people into handing over credentials.

Am I really on the website I intended to visit?

Malware

Malicious software can steal information or monitor what users type.

Keep systems updated, avoid suspicious downloads, and be careful with links and attachments.

Passwords aren't the whole story

Passwords are only one part of account security. Add another factor whenever an account supports it.

Multi-factor authentication

Use more than one kind of proof: something you know, something you have, or something you are.

Authenticator apps

Authenticator apps create short-lived login codes that provide an additional factor beyond your password.

Security keys

Hardware security keys provide a physical factor and can offer strong resistance to phishing.

Passkeys

A passkey uses a cryptographic key pair. The private key stays protected by your device or credential manager, while the public key is stored by the website. During login, your device proves possession of the private key; it is not sent to the website.

Passkeys are highly resistant to many forms of phishing because there is no password to type into a fake page.

They still depend on the security of your devices, accounts, software, recovery methods, and the services around them.

A simple security checklist

Is it long enough?

Is it unpredictable?

Is it unique to this account?

Has it ever been compromised?

Am I storing it safely?

Does this account support MFA or a passkey?

If you can answer these questions confidently, you're already making much better security decisions.

Use what you learned

Generate

Create a long, random password or passphrase instead of trying to invent one yourself.

Create a secure password

Check

Use the Password Checker to understand characteristics such as length, estimated entropy, and potential weaknesses.

Check a password

Protect

Store unique passwords in a password manager and enable MFA or passkeys whenever they're available.

Better passwords are only one part of better security.