Most account hacks happen because people reuse the same weak password everywhere. If one site leaks it, attackers try it on your email, bank and social media. The fix takes about 30 minutes.
What makes a password strong?
- Length first: aim for at least 12 to 16 characters.
- Unique for every account. Never reuse.
- Random, or a long passphrase. For example, four or more unrelated words.
- No personal info: birthdays, names, phone numbers or “password123”.
Create a random password right now with our free strong password generator. It runs in your browser, so nothing is sent to us.
Use a password manager
A password manager stores unique passwords for you, so you only remember one strong master password. It fills logins automatically and can warn you about reused or leaked passwords. Pick a well-reviewed manager, protect it with a long master passphrase and turn on two-factor authentication.
Turn on two-factor authentication (2FA)
2FA asks for a second proof, such as a code, when you sign in. Enable it first on your email, then on banking, social media and your Google account. An authenticator app is usually safer than SMS codes.
30-minute security checklist
- Change your email password to a new, long, unique one.
- Turn on 2FA for email, bank and social accounts.
- Install a password manager and move your top 10 accounts.
- Update the other accounts over the next week.
- Check whether your email appeared in a known breach using a reputable breach-checking service.
Mistakes to avoid
- Saving passwords in a chat or notes app with no protection
- Sharing codes with anyone, even someone who claims to be support
- Entering your password on a link from an email or message. Learn more in our guide to online scams and phishing
Create strong passwords: frequently asked questions
Are password managers safe?
Reputable ones encrypt your data, and they are generally safer than reusing passwords. Protect yours with a strong master password and 2FA.
How often should I change passwords?
Change them when there is a breach or suspicion. A strong, unique password does not need a fixed schedule.
