8 Rules for Passwords That Are Actually Hard to Crack

Passwords remain the front door to almost every account you own, yet most people still secure them with habits that attackers learned to defeat years ago. The good news is that strong protection is simpler than the old rules suggested. Here are eight practical principles that actually work.

1. Length beats complexity

A long password is exponentially harder to crack than a short one, regardless of how many symbols you cram in. A 16-character password drawn from a wide character set is dramatically stronger than an 8-character one with a single exclamation mark. Whenever a site allows it, aim for at least 16 characters.

2. Make every account unique

The single most damaging mistake is reuse. When one website suffers a breach, attackers immediately try the leaked email and password on banks, email providers and shopping sites. A unique password per account means a single leak stays contained.

3. Random beats clever

Patterns you invent feel unique but are predictable to cracking software trained on millions of real passwords. Genuinely random strings, like those from our Password Generator, remove the predictability that humans cannot help adding.

4. Use a password manager

Nobody can remember dozens of long, random passwords — and you should not try. A reputable password manager stores and fills them for you, so the only thing you memorise is one strong master password.

5. Turn on two-factor authentication

Two-factor authentication adds a second step, usually a code from an app, so a stolen password alone is not enough to get in. Enable it everywhere it is offered, especially on email, which is the recovery route for everything else.

6. Stop changing passwords on a schedule

Forced monthly changes lead people to make tiny, predictable tweaks. Modern guidance is to change a password only when you have reason to believe it has been exposed.

7. Beware of where you type it

Even a perfect password fails if you enter it on a fake site. Check the address bar, never log in from links in unexpected emails, and be cautious on shared computers.

8. Check if you have been breached

Use a reputable breach-checking service to see whether your email has appeared in known leaks. If it has, change those passwords immediately and enable two-factor authentication.

Frequently Asked Questions