Strong Passwords and Password Managers

A password is a secret that proves you are the person who owns an account. If someone else learns it, they can act as you. Most advice about passwords comes down to three ideas: make them long, make them unpredictable, and never use the same one twice. The third idea is the one people find hardest, because nobody can remember fifty different passwords.

That is where a password manager comes in. This entry shows you how to build one strong password you can remember, how to let software handle the rest, and how to set it all up in an afternoon. It stays practical and avoids fear. A good password is a solid lock, not a force field, so a later section also points to the other habits that work alongside it.

What makes a password strong

Three qualities matter, and length matters most.

Length

Each extra character multiplies the number of guesses an attacker must try. A short password can be tested very quickly by software. A long one cannot. CISA advises at least 16 characters for passwords you create, and says longer is stronger.

Unpredictability

Attackers do not start with random guesses. They start with the passwords people actually choose: names, birthdays, keyboard patterns like qwerty, and common words with a number on the end. A password is strong when nothing about you or your life would suggest it. Replacing the letter "a" with "@" does not help much, because guessing tools try those swaps too.

Uniqueness

When a website is breached, attackers try the leaked email and password on other services. This is called credential stuffing. If you reuse a password, one breach opens several doors. A unique password for each account keeps the damage in one place. This is the quality that a password manager makes practical.

Passphrases: long and memorable

A passphrase is a password made of several unrelated words. CISA suggests a memorable phrase of four to seven unrelated words. The words must not form a famous phrase, a song lyric or a sentence about you.

Here is a way to build one:

1. Pick four to seven words at random. A dictionary opened to different pages works. So does a word list and dice.
2. Put them in an order that does not make a sentence.
3. Add separators if you like, such as hyphens or spaces.
4. Say it aloud a few times, then type it from memory the next day.

A made-up example is lantern-gravel-orbit-spoon-meadow. Do not use that exact one, since anyone who reads this page knows it. The point is the shape: long, plain words, no personal link.

You need to memorize very few passphrases. Use one for your password manager, one for your main email, and one for the device you use most. A manager can create the rest.

What a password manager does

A password manager is a program that stores your passwords in an encrypted vault. You unlock the vault with one strong passphrase, called the master password. After that, the manager can create long random passwords, save them, and fill them in when you sign in. CISA calls a password manager one of the easiest ways to keep strong, unique passwords, and it notes that managers can also flag weak or reused ones.

Some managers are built into a browser or a phone. Others are separate apps. The tool matters less than the habit, and this entry does not rank products. When you compare options, look for general things:

• The vault is encrypted, and the provider explains how.
• It can create random passwords of your chosen length.
• It works on every device you use.
• It supports two-step sign-in for the vault itself.
• It has a clear recovery option, and you understand how it works.

Many managers match the saved site address before filling a password. If the manager refuses to fill a page where you expected it to, that can be a hint that the page is a look-alike. The phishing entry covers that trick in more detail.

What a manager does not do

A manager does not protect a password you give away to a fake page. It does not fix a weak master password either. And if you forget the master password, some managers cannot reset it for you by design. Read the recovery rules when you set it up, not after a problem.

Setting up a manager: a short checklist

Do this in order, and stop whenever you like. Each step already improves your safety.

1. Choose a reputable password manager and install it on your main device.
2. Create a long, new passphrase as the master password. Do not reuse any existing password.
3. Turn on two-factor authentication for the manager if it offers it.
4. Write down the recovery information the manager gives you, and keep it somewhere safe and offline, such as a locked drawer.
5. Start with your most important accounts: your main email first, then banking, then work and shopping accounts. Email matters most because password resets are usually sent there.
6. For each account, let the manager generate a new random password and save it.
7. Add the manager to your phone so you are not tempted to go back to old habits.

Do not try to change everything in one sitting. Change a few accounts a day and you will finish within a week or two.

What official guidance says

NIST publishes rules in SP 800-63B for the services that check your password. It is written for organizations, but it shows what current thinking looks like. The table summarizes points from the current edition (revision 4):

The lesson for you is simple. Long beats complicated, and you do not need to rotate a strong password on a schedule. Change it when you have a reason, such as a breach notice or a suspicion that someone saw it. The two numbers differ slightly. NIST's 15 is a minimum that services must enforce, while CISA's 16 is advice for people choosing a password. Aim for 16 or more.

Common mistakes

• Reusing one password "with small changes". Summer2024# and Summer2025# are easy for tools to guess from each other. Use fully separate passwords.
• Using personal facts. Pet names, birthdays and addresses can often be found online by anyone who looks.
• Making a password short but complicated. Eight characters with symbols is weaker than a long passphrase of plain words.
• Storing passwords in a plain note or spreadsheet. CISA advises against writing passwords down or keeping them in a file. An encrypted vault is built for this job.
• Sharing a password by message. Anyone who sees the message can see the password. Use a sharing feature in the manager or change the password afterward.
• Skipping the email account. Email can reset most other accounts, so it deserves your longest passphrase and a second sign-in step.

FAQ

Is a password manager safe to use?

It is safer for most people than reusing passwords, because it lets you use a unique password everywhere. No tool is perfect, so protect the vault with a long master password and two-step sign-in.

How long should my password be?

CISA advises at least 16 characters. CISA suggests a passphrase of four to seven unrelated words. Choose words long enough that the whole phrase reaches at least 16 characters.

Do I need to change my passwords regularly?

Not on a fixed schedule. NIST tells services not to force periodic changes. Change a password when you learn of a breach, see an unfamiliar sign-in, or suspect someone saw it.

Can I let my browser save passwords?

A browser's built-in manager is better than reusing weak passwords. Make sure the device itself has a lock screen and that the browser account is protected by a strong passphrase.

What if I forget the master password?

It depends on the manager. Some offer a recovery key or a trusted contact, and others cannot recover the vault at all. Check this on day one and store the recovery information safely. More habits like this live in the Security Basics area.