How to create a secure password that is easy to manage

For a personal account, at least 16 characters is a useful practical target. CISA recommends passwords that are long, random and unique, and suggests a passphrase of five to seven unrelated words when something must be memorized.

Length helps, but it does not compensate for reuse. One long password used across five services creates a common point of failure: if one service is breached, somebody can try the same credentials elsewhere.

• Long: use 16 characters or more when the service allows it.
• Random: avoid patterns, dates, names, sports teams and familiar phrases.
• Unique: every account gets a different password.
• No personal information: exclude details that can be found on social media.

Option A: random password

For accounts stored in a manager, generate a random combination of uppercase and lowercase letters, numbers and symbols. Use as much length as the service accepts. Never copy a published example as a real password.

Option B: passphrase

If it must be memorized, combine several unrelated words. Do not use a quotation, lyric or familiar expression. Human-created phrases are usually less unpredictable than random output, but a sufficiently long and truly unique passphrase can work for a master password.

A password manager can generate, store and fill unique credentials, leaving only its master password to remember. CISA recommends using one to remove the burden of memorizing many different passwords.

1. Choose a reputable manager and keep it updated.
2. Create a long, exclusive master password used nowhere else.
3. Enable MFA on the manager itself.
4. Keep recovery codes away from your primary device.
5. Review and replace any reused or weak credentials it detects.

Do not keep passwords in an unprotected note, plain-text document, email to yourself or open spreadsheet.

MFA adds another check during sign-in. Even if a password is stolen, an attacker still has to overcome the second step. Enable it first on email, your password manager, financial accounts, cloud storage and social networks.

When there is a choice, use the strongest method supported by the service, such as a security key or authenticator app. Properly configured MFA is generally preferable to relying on a password alone.

You do not need to replace a strong password every few weeks solely because of a calendar. Current NIST guidance says services should not require arbitrary periodic changes and should force a change when there is evidence of compromise.

Change it immediately after a legitimate breach alert, unknown sign-in, accidental disclosure, suspicious website entry or discovery of reuse. Then close active sessions, review recovery methods and enable MFA.

• Replacing one letter with a number in a predictable word.
• Adding the current year to the same password.
• Using one base and changing only the service name.
• Reusing the email account password.
• Sharing credentials through chat or email.
• Using recovery answers that others can research.
• Ignoring access or breach alerts.

• ✓It has 16 characters or more when the service permits.
• ✓It contains no personal data or easily guessed patterns.
• ✓It is not used by another account.
• ✓It is stored in a password manager.
• ✓MFA is enabled on the account.
• ✓Recovery codes are stored safely.
• ✓You know how to verify alerts without opening suspicious links.