What a password is protecting
A password is a shared secret between you and a service: if you can produce it, the service treats you as the account owner. That makes it a key to more than the account itself. Email accounts often control password resets for other services, and many accounts hold personal details, payment methods or private messages. Weak or reused passwords are therefore less about one login and more about the chain of accounts connected to it.
Nothing here can make an account perfectly safe. The aim is to make guessing, theft and takeover harder, and to limit the damage if something goes wrong.
How passwords get compromised
Understanding the common routes explains most of the advice.
- Guessing. Attackers try likely passwords: common words, names, dates, keyboard patterns such as “qwerty”, and the most popular choices from past leaks. Programs can try huge numbers of guesses far faster than a person could.
- Credential stuffing. When a site suffers a data breach, lists of emails and passwords can circulate. Attackers then try the same pairs on other services, betting that people reused them.
- Phishing. A convincing fake message or page asks you to type your password, and you hand it over yourself. Phishing scams work whatever the password’s strength.
- Malware and shoulder surfing. Software that records keystrokes, or someone watching you type, can capture a password.
- Poor storage by the service. Well-run sites store only a scrambled form of each password, but not all do.
A strong password helps mostly against guessing. It does not help much against phishing or a service that stores passwords badly, which is why uniqueness and a second sign-in step matter too.
What makes a password hard to guess
Length matters most. Each extra character multiplies the number of possibilities an attacker must try. If a password uses only lowercase letters chosen at random, each character has 26 options. Eight such characters give 26 to the power of 8, which is 208,827,064,576 combinations, roughly 209 billion. That sounds large, but modern guessing tools are fast, and passwords people actually pick are far more predictable than random ones. Length plus unpredictability is what counts.
Unpredictability matters more than complexity. Swapping letters for lookalike symbols, as in “P@ssw0rd!”, follows patterns that attackers already include in their guesses. Adding “1!” to a common word has little effect.
Passphrases are a practical option. A passphrase is several unrelated words, such as four chosen at random from a large word list. If the list holds 7,776 words, as in some well-known dice-based lists, four random words give 7,776 to the power of 4, about 3.7 quadrillion possibilities, and are easier to remember than a jumble of symbols. The words must be truly random. A famous quote, song lyric or phrase with personal meaning is much easier to guess.
Avoid personal information. Names of family members or pets, birthdays, addresses and favourite teams are often findable on social media or in public records.
Do not rely on forced changes. Many security guidelines now suggest changing a password when there is a reason, such as a breach or suspected compromise, rather than on a fixed schedule, because frequent forced changes tend to push people towards predictable tweaks. Rules differ between organisations, so follow your workplace’s policy.
Why reuse is risky
If one password opens many accounts, a single leak puts all of them at risk. The weakest site you use becomes the weak link for the rest. Because stolen lists are tried against many services automatically, reuse can be exploited without anyone targeting you personally.
Using a different password for every account means a breach at one site stays contained. The email account that receives reset links deserves the strongest, most carefully protected password of all.
Remembering many passwords
Nobody can memorise dozens of long, unique passwords. Common options are:
- A password manager. It generates and stores unique passwords and fills them in for you, so you remember only one strong master passphrase. It is the most common route, though it has trade-offs such as relying on one master passphrase.
- A paper notebook kept at home. Less convenient, and not useful away from home, but safe from online attackers. Its risk is loss or someone with access to your home.
- Memory for a few key passwords, such as your device login and your email, with the rest handled by a tool.
Storing passwords in an unprotected note or spreadsheet, or in a browser on a shared computer, is typically riskier. Browsers’ built-in password saving is better than reusing one password everywhere, but protecting the device itself, for instance with device encryption and a screen lock, becomes important.
Adding a second step
Two-step sign-in, also called two-factor authentication, asks for something besides your password, such as a code or an approval on your phone. Even if someone has your password, they typically also need the second step.
Methods vary in strength. Codes from an authenticator app are generally considered stronger than codes sent by text message, which can be intercepted in some situations such as SIM swapping. Physical security keys are widely regarded as the strongest common option, particularly against phishing. Any second step is usually better than none.
Passkey login is a newer approach that replaces the password with a cryptographic key stored on your device and unlocked with a fingerprint, face or PIN. Support is growing but not universal, so passwords will remain in use for some time.
Protecting your wider identity
A strong password is one part of account security. A few related habits help:
- Be cautious with unexpected messages that ask you to click, sign in or share a code. Social engineering relies on urgency and trust.
- Check the web address before typing credentials.
- Keep devices and apps updated so known flaws are fixed.
- Set up account recovery options carefully, and keep them current.
- Share as little personal information as practical, since details you post can answer security questions or help impersonators.
- Treat security questions as extra passwords: answers that are true and easy to find are weak, so some people use random answers stored in their password manager.
If something goes wrong
If you think a password has been exposed, change it on that site straight away, change it anywhere else you used it, and turn on two-step sign-in. Check recovery details in case an attacker added their own. Watch financial statements for unfamiliar activity. If the account has been taken over, follow the provider’s recovery process.
A sensible starting point
If you only do a few things: use a unique, long password or passphrase for your email and key accounts, turn on two-step sign-in wherever offered, and be wary of messages asking you to log in. Improving the rest gradually is better than attempting a perfect overhaul and giving up.