Strong Passwords and Password Managers

For years we were told to mix in capitals, numbers and symbols and change passwords every 90 days. The experts changed their minds. People responded to those rules with predictable tricks like Summer2026!, which attackers try early.

The US government's digital identity guideline, NIST SP 800-63B, now says websites should:

• Require at least 15 characters when a password is the only thing protecting an account (at least 8 when it's paired with a second factor).
• Allow passwords of at least 64 characters, including spaces.
• Not force composition rules like “one capital, one symbol.”
• Not force regular password changes, only when there's evidence of a breach.
• Block passwords that are common or known to be leaked, and allow password managers and pasting.

CISA, the US cybersecurity agency, gives everyday advice that lines up: make every password long (at least 16 characters), random, and unique to each account.

A passphrase is several random words strung together. The key word is random. A phrase you choose yourself, like a song lyric or ilovemydog, is predictable. Words picked by a computer (or by rolling dice) are not.

Each random word from a list of 2,048 words adds 11 “bits” of unpredictability, which means it multiplies the number of guesses needed by 2,048. Five words is about 2,048⁵, roughly 36 million billion possibilities. Use at least 5 words, and 6 or more for your most important ones, like email and your password manager's master password.

Capitals and numbers add very little when they follow a pattern everyone uses (first letter capital, number on the end). One more random word adds more than both together. Add them only if a site insists.

• Guessing online: an attacker types guesses into a login page. Good sites slow this down or lock the account, so only very common passwords fall this way.
• Cracking offline: when a company is breached, attackers may steal its scrambled (hashed) passwords and test billions of guesses per second on their own computers. Common words, names, dates and keyboard patterns go first.
• Credential stuffing: attackers take email and password pairs leaked from one site and try them on banks, email and shopping sites. If you reused that password, they're in, no cracking needed.
• Phishing: a fake login page simply asks you for it. No password is strong enough to survive being typed into a scam page. See How to Spot a Scam.

Never reuse a password, especially for email. Your email can reset every other account, so a leaked password from some old forum could unlock your whole online life.

The checker looks for the same shortcuts attackers use: common passwords, dictionary words, letter-to-symbol swaps (@ for a), years, keyboard runs like qwerty, and repeated characters. Its times are rough estimates using two assumptions: an online attack against a site that limits tries (about 100 guesses an hour) and an offline attack on leaked, quickly hashed passwords (about 10 billion guesses a second). That second number is a worst case: well-run sites store passwords with deliberately slow hashing, which cuts attackers to a tiny fraction of that speed.

Nobody can remember 100 long, unique passwords. A password manager does it for you: it creates a strong random password for each site, saves it in an encrypted vault, and fills it in when you log in. You remember just one strong master password (a passphrase is perfect).

Set one up in 5 steps

1. Pick a manager and create a long master passphrase. Write it on paper and store it somewhere safe at home until you know it by heart.
2. Turn on two-factor authentication for the manager itself.
3. Import passwords saved in your browser, or let it save them as you log in.
4. Start with your most important accounts: email, bank, phone carrier, and the manager's recovery options.
5. Use the manager's security check to find weak, reused and leaked passwords, and change them a few at a time.

Is it safe to put everything in one place? A good manager encrypts your vault so the company can't read it. One strong master password plus two-factor authentication is far safer than reusing passwords, which is what most people do without one.

A passkey replaces the password with a pair of digital keys. One stays on your phone, computer or password manager. The website only stores the other, public half. You unlock it with your fingerprint, face or device PIN.

• Phishing-proof: a passkey only works on the real website it was made for, so a fake look-alike site can't use it.
• Nothing to steal from the site: a breach of the website doesn't reveal anything an attacker can log in with.
• Nothing to remember or type.

To set one up, look in an account's Security or Sign-in settings for “Passkeys” or “Create a passkey.” Many big services, including Google, Apple, Microsoft and Amazon, support them. Your passkeys sync through your password manager, so a new phone gets them too.

Keep a backup way in. Before relying on passkeys, make sure your account recovery options (a recovery email, phone number or recovery codes) are up to date.

Data breaches are common, so assume some of your old passwords have leaked. You can check:

• Your password manager: Apple Passwords, Google Password Manager, Edge and most standalone managers warn you about passwords that appear in known breaches.
• Have I Been Pwned (haveibeenpwned.com): enter your email to see which known breaches included it. It's a long-running free service many security teams use.

If your password showed up in a breach

1. Change it on that site to a new, unique one.
2. Change it everywhere else you used the same or a similar password.
3. Turn on two-factor authentication or a passkey where you can, starting with email and banking.
4. Watch for phishing emails that mention the breach. Go to the site directly, don't click links.

No legit company will ask for your password by phone, text or email. Anyone who does is a scammer.