How to create a strong password you can actually use
2 min read · Updated October 15, 2026
A strong password is long, unique and hard to guess. Aim for at least 14 characters, ideally a random string from a password manager or a passphrase of four or more unrelated words. Never reuse it on another account, and never base it on names, dates or keyboard patterns.
What makes a password strong
- ✓Length: every extra character multiplies the work for an attacker.
- ✓Randomness: no names, birthdays, pets, sports teams or keyboard runs like ‘qwerty’.
- ✓Uniqueness: one password per account, so one leak cannot unlock others.
Passphrases: strong and memorable
A passphrase is several unrelated words, such as three or four random words strung together, for example ‘lantern orbit pancake rivet’. It is long enough to resist guessing and easier to remember than a jumble of symbols. Use it for the few passwords you must memorise, such as your password manager and your device login.
Is your login already in a leak?
Strong habits help most when you know which accounts are already exposed. Check your email address for free.
What to avoid
- ✓Adding a number or ‘!’ to a common word.
- ✓Substituting letters with look-alikes such as ‘p@ssw0rd’. Cracking tools check these.
- ✓Using personal information that appears on social media.
- ✓Reusing a password with tiny changes between sites.
Let a password manager do the work
Nobody can remember dozens of unique 16-character passwords. A password manager generates and stores them, then fills them in for you. You remember one strong passphrase for the manager and let it handle the rest.
Frequently asked questions
Is 8 characters enough?+
Not anymore. Longer is much safer. Aim for at least 14 characters for important accounts.
Do I need to change passwords regularly?+
Not on a fixed schedule if they are strong and unique. Change them when a breach or suspicious activity occurs.
Are special characters required?+
They help a little, but length and randomness matter more.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.