How to Create Strong Passwords: Long, Random and Unique

The three rules

The US Cybersecurity and Infrastructure Security Agency (CISA) says a strong password follows all three of these tips:

1. Make it long. At least 16 characters. Longer is stronger.
2. Make it random. Use a random string of mixed-case letters, numbers and symbols, or a passphrase of 4 to 7 unrelated words. CISA's example passphrase is HorsePurpleHatRunBay, and it says you can use spaces between words.
3. Make it unique. Use a different strong password for each account.

What not to use

CISA says simple passwords such as 12345, or common identifying information like birthdays and pet names, are not safe for protecting important accounts. It compares an easy-to-guess password to locking the door but leaving the key in the lock.

Use a password manager

CISA notes it is hard to remember a unique strong password for every account and advises against saving them in a file on a computer. A password manager is a program that generates, stores and fills in your passwords, and it can tell you about weak or re-used ones. You then remember one strong password for the manager.

Pair it with a second step

A strong password is one layer. Turn on multi-factor authentication too (see our MFA guide).

Quick actions

• Start with your email and banking accounts.
• Replace any re-used passwords.
• Never share passwords by message.

Fact-checked on 30 October 2026 against the sources listed below. Prices and plans change, so confirm with the provider before you buy.