Password security basics

Good password security is a repeatable account routine, not a contest to invent the strangest string. The aim is to make every credential difficult to guess, different from credentials used elsewhere, and recoverable if a device is lost. A long password reused across several sites can still put all of those accounts at risk when one service is breached. Start with the accounts that control recovery, then make unique credentials and backup methods manageable enough that you will keep using them.

Start with the accounts that unlock others

An email account often receives password reset links and security alerts. If someone controls it, they may be able to take over other accounts even when those accounts have stronger passwords. Secure your primary email first: give it a unique password, turn on multifactor authentication, verify its recovery address and phone number, and remove old devices or recovery methods you no longer control.

Apply the same reasoning to a password manager, cloud account, phone account, and financial account. These are control points because they can unlock data or help reset other credentials. Check recent sign-in activity and connected devices from the service's own settings page. If you see a session you do not recognize, revoke it and change the affected password from a trusted device.

Make every account's password different

Reusing a password creates a chain reaction. Criminals routinely test credentials exposed by one breach against unrelated services, a practice called credential stuffing. Changing one character or adding a site name does not create a dependable boundary because those variations are predictable. If one service is breached, a truly different password prevents that exact secret from opening your other accounts.

A password manager makes this rule realistic. It can generate a long random password for each site, save the service address beside it, and fill it when you return. Choose a reputable manager whose security and recovery model you understand, protect its vault with a unique strong master password, and enable an additional sign-in factor where available. Keep a secure way to recover the vault if its only device is lost.

Choose random credentials you can actually use

For accounts managed by a password manager, let its generator choose a random string within the service's allowed character set. Random selection matters because people tend to choose patterns that look varied but remain easy to predict: a familiar word, a capital letter, a year, and a symbol at the end. Those habits help memory, but they do not make a predictable base secret independent or unique.

For a secret you need to remember, a passphrase made from several unrelated words chosen independently at random can be easier to enter. Avoid quotations, song lyrics, names, sports teams, keyboard walks, and details visible on social profiles. Do not use a phrase published in a guide or generated in a screenshot; a public example is no longer secret. Check that the service accepts the full phrase before committing to it.

Understand what length guidance means

CISA's consumer tip sheet recommends long, unique passwords and describes at least 16 characters as a useful target; it also presents five to seven unrelated words as a memorable passphrase approach. NIST SP 800-63B-4 sets a minimum of 15 characters for passwords used as a single authentication factor by covered digital identity verifiers. It also says those verifiers should permit a maximum length of at least 64 characters and should not impose extra character-mix rules.

These documents address different audiences. NIST specifies requirements for organizations that verify digital identities under its guidance; it is not a universal password law for every consumer website. A service can impose a shorter technical limit, even when that is frustrating. Use the longest unique secret the service accepts, avoid truncation, and prefer a manager-generated value when there is no reason to memorize it.

Add another sign-in factor

Multifactor authentication asks for another proof in addition to a password, such as an authenticator-app code, a security key, or a device approval. This can limit account takeover when a password is phished or reused elsewhere. Turn it on for your email, password manager, financial services, work accounts, and other services whose loss would matter. Prefer a phishing-resistant security key or passkey when the service and your devices support one.

Not all second factors protect against the same attacks. A text message can be more useful than a password alone, but it can be exposed through phone-number takeover or message interception. An approval prompt can also be abused if you accept requests you did not initiate. Read each prompt, deny unexpected requests, and keep a backup method that you can reach without leaving the primary account unprotected.

Plan recovery before a device disappears

Recovery is part of security because a perfect login credential is not helpful if losing one phone permanently locks you out. Save one-time recovery codes when a service offers them and store them in a protected location separate from the account they recover. A password manager's secure note or a carefully stored offline copy may work, depending on your threat model. Do not leave the only copy in the same inbox or phone that the account depends on.

Review the recovery email address, phone number, trusted devices, and backup factors after a major life or device change. Make sure you still control each one. Before replacing a phone, move authenticator access deliberately and test the new method while the old device still works. Be wary of anyone who contacts you unexpectedly and asks for a reset code; a legitimate support worker should not need the code that proves control of your account.

Change a password when there is a reason

Routine calendar-based password changes can encourage small predictable edits and do not necessarily remove an attacker's access. Change a password promptly when a service reports a breach, you entered it into a suspicious page, you shared it with someone who should no longer have access, or you discover reuse. Change it from a trusted device, then review active sessions and sign out devices you do not recognize; changing the password alone may not end every session.

If you suspect takeover, secure the email or manager that can reset the account, use the provider's official recovery process, replace the exposed password with a unique one, and check recovery settings for changes you did not make. Contact the provider through a known support channel if access is gone. Keep notes about what you changed, but do not record the new secret in an ordinary document or support ticket.

Treat strength meters as limited feedback

A strength meter can point out short length, repeated characters, or obvious sequences, but it cannot certify that a password is safe. It may not know whether the value appeared in a breach, was reused elsewhere, came from personal information, or was typed into a fake sign-in page. A high score describes the checks that one particular meter performs; it does not assess every route by which an account could be lost.

Use a local checker only with a sample when you are unsure how it processes input. Do not paste a live password into a random website to get a score. For an everyday workflow, generate a unique value, save it in a manager, enable another sign-in factor, and confirm recovery. Those habits address more of the real problem than adding punctuation to an old password or chasing a perfect meter score.

Quick checklist

• Secure your primary email and password-manager accounts first.
• Use a different, long password for every account.
• Turn on MFA for important accounts and review backup methods.
• Store recovery codes separately from the account they recover.

Try it locally

Use these related utilities to turn the note into a practical workflow.

• Passphrase Generator
• Password Strength Checker

Learn how this material is prepared in the SafeStack Editorial Policy.