Length beats cleverness
Every extra character multiplies the work an attacker must do. A short password with symbols is still short; a long password made of ordinary words is usually far stronger. That is why security guidance has shifted from “use symbols and numbers” to “make it long”. A passphrase of four or five random words — for example, “correct horse battery staple” in the classic illustration — is both memorable and difficult to guess by brute force.
The key word is random. A phrase from a song, a quote, or your favourite team is guessable because attackers try those first. Pick words that have no connection to each other and no connection to you, and do not reuse a phrase you have posted publicly anywhere. If you want true randomness, generate the words with a tool rather than choosing them yourself.
Uniqueness matters more than complexity
The most common way passwords fail is not someone guessing yours — it is a breach at one website leaking a password you reused everywhere else. If your email password is also your banking password, one leak compromises both. The single most valuable habit in password security is therefore simple: never reuse an important password.
This is where most people get stuck, because nobody can remember fifty unique passwords. That is not a personal failure; it is a design problem, and it has a standard solution: a password manager. You remember one strong master passphrase, and the manager remembers the rest, generating long random passwords for each site.
A practical method you can use today
Start with your most important accounts: email first, then banking, then anything that can reset other accounts. Give each a unique, randomly generated password from a password manager, or a long random passphrase where you must type it by hand. Turn on two-factor authentication on email and banking — an authenticator app is better than SMS where both are offered.
For accounts you rarely use, a generated password stored in the manager is fine even if you never memorise it. For the master passphrase itself, write it on paper and keep it somewhere safe at home until you have typed it enough times to remember it; do not store it in an email, a note on your phone, or a file named “passwords”.
Also save your recovery codes. When you turn on two-factor authentication, most services show one-time backup codes for the day you lose your phone or authenticator app. Print those codes or write them down and store them with your master passphrase note, not in the same cloud account they protect. Without a recovery code, regaining access can take days of identity checks, and with one it usually takes minutes.
What not to do
Do not use birthdays, pet names, addresses, or keyboard patterns like “qwerty123”. Do not share passwords by email or chat, and do not enter your password on a site you reached through an unexpected link — go to the site directly instead. Be wary of “security questions” that ask for facts anyone can find, such as your mother's maiden name or your first school; where possible, answer them with random words stored in your manager, just like passwords.
Changing passwords on a fixed schedule does not help much on its own. Change a password when there is a reason: a breach at that service, a device you no longer control, or a password you shared and should not have. Otherwise, a long unique password that has never leaked can stay in place.
How to check your current passwords
Take ten minutes to list your accounts in rough order of importance and mark which ones share a password. Move the important ones to unique passwords first, and enable two-factor authentication as you go. Most browsers and password managers can also flag passwords that have appeared in known breaches — treat those as a prompt to change them, not as proof that your account has already been taken over.
If you suspect an account has been compromised, change its password from a device you trust, check its recent activity and connected sessions, and change any other account that shared the same password. Then turn on two-factor authentication before doing anything else.
Try the related tools
Try the Password Generator on Daily Tools. Try the Random Number Generator on Daily Tools. Try the Base64 Encoder / Decoder on Daily Tools.
Frequently asked questions
How long should a password be?
Aim for at least 14 characters, and longer for your master passphrase and email. Length matters more than adding a symbol to a short password.
Is a passphrase really stronger than a complex password?
A long random passphrase usually is, because each added word multiplies the guessing work far more than swapping a letter for a symbol.
Do I need a password manager?
If you have more than a handful of accounts, yes — it is the only practical way to keep every password unique without memorising them all.