Appearance
Summary
Weak and reused passwords are the most common cause of account breaches. This article explains how to create strong, memorable passwords, why reusing passwords is dangerous, and how to use a password manager to stay protected without memorising dozens of credentials.
Before You Start
- None. This guidance applies to all users on any device or platform.
Instructions
1. Understand Why Passwords Get Compromised
Know the risks so you can avoid them.
Most password breaches happen because of one of three reasons:
- Reuse — You use the same password on multiple sites. One breach exposes all of them.
- Weak passwords — Short passwords or common words (like
Password1!orWelcome2024) are cracked in seconds by automated tools. - Phishing — You enter your password on a fake login page. The attacker now has it. How to identify a phishing email covers the signs to look for.
The good news: strong, unique passwords block the first two entirely, and MFA protects you from the third.
Where a site supports passkeys, you can remove the password rather than protect it. A passkey is tied to the real website, so there is nothing to reuse across sites and nothing to type into a fake login page — the two failure modes above stop applying to that account. How to Set Up and Use Passkeys on Your Phone and Browser covers turning one on. Most sites do not offer them yet, so the rest of this guide still matters for everything else.
2. Build a Strong Password Using the Passphrase Method
Create a password that is both strong and memorable.
A passphrase is a string of random, unrelated words. It is much harder to crack than a short, complex password — and much easier to remember.
How to create one:
- Pick four or more random, unrelated words. Do not use a famous quote, song lyric, or common phrase.
- Example:
correct horse battery staple(16+ characters, and a picture you can hold in your head)
- Example:
- Make it personal by adding a number or symbol between words if the site requires mixed character types.
- Example:
Maple7-Rocket-Candle-Frog
- Example:
- Aim for 16 characters or more. Length is the single most important factor in password strength.
Why this works: A 4-word passphrase has billions of possible combinations. A brute-force attack that cracks P@ssw0rd! in seconds would take centuries to crack Maple7-Rocket-Candle-Frog.
3. Know What "Strong" Actually Means
Length beats complexity every time.
| Factor | Weak Example | Strong Example |
|---|---|---|
| Length | Tr0uble! (8 chars) | Trouble-Free-Mango-Cloud (25 chars) |
| Predictability | Summer2026! (calendar-based) | Penguin-Vault-Copper-9 (random words) |
| Reuse | Same password on email, banking, and social media | A unique password for every account |
Rules of thumb:
- 16+ characters is the current best practice.
- Avoid names, birthdays, pet names, keyboard patterns (
qwerty,123456), and single dictionary words. - Never use a password that has appeared in a data breach. Your browser or password manager can check this for you.
4. Stop Reusing Passwords
One breach should not compromise every account you own.
When a website gets hacked, attackers take the stolen passwords and try them on other sites — banks, email, social media. This is called credential stuffing, and it works because most people reuse passwords.
The fix: Use a unique password for every account. A password manager (see Step 5) makes this practical.
At minimum, use unique passwords for:
- Your work email (Microsoft 365 / Google Workspace)
- Your personal email (this is the recovery address for everything else)
- Your bank and financial accounts
- Any account with sensitive personal data
5. Use a Password Manager
Let a tool remember your passwords so you do not have to.
A password manager stores all your passwords in an encrypted vault. You remember one strong master password — the manager handles the rest. Setting up and using a password manager walks through choosing one and moving your accounts across.
Options already available to you (no install required):
- Microsoft Edge — Built-in password manager synced to your Microsoft account. Access at Settings > Profiles > Passwords.
- Google Chrome — Built-in password manager synced to your Google account. Access at Passwords and autofill > Google Password Manager.
Standalone password managers (for more control):
- Bitwarden — Free tier available. Works across all devices and browsers.
- 1Password — Paid. Popular with businesses and families.
How to get started:
- Choose a password manager (your browser's built-in option is a great starting point).
- Let it save your passwords as you log into sites normally.
- When creating new accounts, use the password generator to create strong, random passwords automatically.
- Over time, replace your weakest and most reused passwords with unique generated ones.
6. Respond to "Compromised Password" Alerts
Take action when your browser warns you.
Both Edge and Chrome monitor your saved passwords against known data breaches. If you see a warning:
- Open your browser's password settings (see Step 5 above).
- Look for a section labelled Password checkup (Chrome) or Password health (Edge).
- Review the list of compromised or reused passwords.
- For each flagged entry, go to that website and change your password immediately.
- Use the browser's password generator to create a strong replacement.
Troubleshooting
TIP
You do not need to change all your passwords at once. Start with your most critical accounts — work email, personal email, and banking — then work through the rest over the coming weeks. Progress beats perfection.
| Symptom / Error | Potential Cause | Solution |
|---|---|---|
| "Password too short" error on a website | Site requires a minimum length | Use the passphrase method from Step 2 — passphrases naturally exceed minimum length requirements. |
| "Must include a special character" error | Site enforces complexity rules | Add a hyphen, period, or number between your passphrase words (e.g., Maple.Rocket.Candle.7). |
| Browser not offering to save passwords | Password save prompt is disabled | Go to your browser's password settings and toggle Offer to save passwords on. |
| Compromised password alert but you already changed it | Browser still has the old password saved | Update the saved entry in your browser's password manager to clear the alert. |
Related Articles
- How to Manage Saved Passwords in Your Browser
- How to Use the Browser Password Generator
- How to Change Your Microsoft 365 Password
- How to Enable Two-Step Verification on Personal Accounts
- How to Set Up and Use Passkeys on Your Phone and Browser
- Understanding Microsoft 365 Account Security — What Protects You and Why