What is a strong password?
Definition
A strong password is one that's long enough and unusual enough that criminals can't guess or crack it, and that you don't reuse anywhere else.
- Category
- Security
- Also called
- secure password, good password
- Last updated
The UK's National Cyber Security Centre (NCSC) puts it simply: the longer and more unusual a password is, the harder it is for a criminal to crack. Weak ones can be cracked in seconds.
The old advice was to stuff a password with symbols, capitals and numbers. The NCSC calls that longstanding advice unhelpful, because most of us have lots of passwords and nobody can memorize that many complicated ones. People end up reusing them or writing the same pattern with a number on the end.
Three random words
The NCSC recommends combining three random words, for example applenemobiro. That's long enough and strong enough for most purposes, and you can actually remember it. "Random" matters: pick words that don't relate to each other, not a lyric or a phrase from a book.
What makes a password weak
- It's on the list of most common passwords, such as "password".
- It's built from a birthday, a sports team, or a family member's or pet's name. Much of that can be found on your social media profile.
- It swaps letters for look-alike characters, like an o for a zero. The NCSC points out that criminals know these tricks too, so it's barely stronger and harder to remember.
A password manager can create strong passwords for you and remember them, so you only memorize one. The NCSC also says writing a password down is fine if you keep it somewhere safe.
Strong vs. unique
A strong password you reuse isn't safe. If one site leaks it, attackers try it on your other accounts (credential stuffing). Strong and unique together is the goal.
How to protect yourself
- 1
Use three random words for the passwords you have to remember
That means your password manager's master password and your device log-in. Avoid names, dates and anything on your social profiles.
- 2
Let a password manager do the rest
It generates a different strong password for every account and fills them in, so you aren't tempted to reuse one.
- 3
Never reuse a password
One leaked password shouldn't open your email, bank and shopping accounts at the same time.
- 4
Turn on two-step verification
Even a strong password can be phished. A second step on your email and financial accounts stops most account takeovers that start with a stolen password.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
How long should a strong password be?
The NCSC doesn't give a fixed number. Its advice is to make passwords long, such as three random words together, rather than short and full of symbols.
Do I need symbols and numbers in my password?
Not necessarily. The NCSC says swapping in characters like a zero for an o doesn't make a password much stronger, since criminals know the trick. Length and unpredictability matter more.
Is it OK to write my passwords down?
The NCSC says yes, provided you keep them somewhere safe. A password manager is usually the better option.
Sources
Something wrong or out of date? Tell us and we'll re-check it.