A strong password is long, unique to one account, and hard to guess. The practical way to get there is a password manager that creates and stores a different secret for every site, plus a memorable passphrase for the manager itself and for email.
A strong password is long, unique to one account, and hard to guess. The practical way to get there is a password manager that creates and stores a different secret for every site, plus a memorable passphrase for the manager itself and for email. The UK National Cyber Security Centre (NCSC) urges people to use password managers and to keep a strong, separate password for email. Many sites now also offer passkeys, which the NCSC recommends as a first choice where available.
This guide is for readers in the UK and US who want clear steps without myth-busting theatre. You can generate candidate passwords with the free password generator on mfaysal.com, then store the winners in a manager rather than a sticky note.
Contents
Length and uniqueness matter more than sprinkling punctuation into a short word. Attackers try leaked passwords, common words and automated guesses. If you reuse one password and it appears in a breach, every other account that shares it is at risk.
NIST digital identity guidelines (SP 800-63B) have pushed organisations toward longer secrets, checks against known breached passwords, and away from arbitrary composition rules and forced periodic resets when nothing has gone wrong. You do not need to memorise standard numbers from NIST to benefit: favour length, uniqueness and breach screening over complex rituals.
| Approach | Strengths | Watch-outs |
|---|---|---|
| Short complex string | Looks complex | Easy to reuse; hard to remember; often guessed |
| Long random string from a manager | High entropy; unique per site | Needs a manager and a strong primary password |
| Diceware-style passphrase | Memorable; long | Must be unique; avoid famous quotes |
| Passkey | Phishing resistant; no typing | Not every site supports them yet |
Protect email first. If someone controls your inbox, they can reset passwords elsewhere. The NCSC tip on using a strong and separate password for email is the right starting point.
US and UK readers face the same core threats: credential stuffing from leaked databases, phishing pages that copy bank logins, and malware that steals browser-saved passwords. A unique password stops stuffing from spreading. A manager auto-fill that only runs on the real domain reduces casual phishing success. Passkeys and 2SV close more of the remaining gaps.
Think in accounts, not in clever spellings. One long unique secret per account beats one ornate password shared everywhere.
A passphrase strings several unrelated words together so the secret is long enough to resist guessing but still memorable. Diceware-style methods pick words with dice and a word list so the choice is random rather than a favourite lyric or film title. Randomness is the point: famous example phrases from articles should never be reused as your real password.
Write a process, not a pet name. For example, roll or generate four or five uncommon words, separate them with spaces or a character you will remember, and only then store the result. Avoid birthdays, team names, street addresses and keyboard walks such as qwerty.
Passphrases shine as the primary password for a password manager or for the few secrets you must type often. For dozens of shopping and social accounts, let a manager generate long random strings instead of inventing a new passphrase each time.
Never place your only copy of a passphrase in an unencrypted notes app that syncs everywhere without a lock. If you write it on paper, store the paper like you would store bank documents, as the NCSC discusses when it covers writing passwords down carefully.
Combine words that do not form a common sentence about your life. Attackers know people pick hobby phrases. Random word lists beat autobiographical phrases every time. If you must invent without dice, close your eyes and pick from a large printed word list rather than from memory of your favourite books.
Spaces inside a passphrase are fine on modern sites. If a site rejects spaces, join words with hyphens. If it rejects long secrets entirely, that site is a good candidate for a manager-generated string and for enabling 2SV immediately.
Password managers create strong unique passwords, fill them on the right site, sync across your devices and warn you about known breaches. The NCSC guidance on managing your passwords explains why managers beat memory for everyday accounts.
You can start with the manager built into your browser or operating system, or install a third-party manager if you need cross-browser sync and richer features. On shared or public computers, never allow the browser to save passwords. On a household PC, decide whether other users should be able to unlock the same profile.
Choose a primary password you can remember under stress: a long passphrase is ideal. Turn on two-step verification for the manager account itself so a stolen primary password is not enough. Update your devices and browsers so auto-fill and vault encryption stay current.
When you migrate, change the most important accounts first: email, banking, work single sign-on, Apple or Google account, and the manager. Use a trusted generator if you need a one-off secret before the vault is ready, then save it into the manager immediately.
Third-party managers often add breach alerts and secure sharing for families. Pick features you will actually use. The best manager is the one you keep open every day. Export a sealed backup only if you understand how to store that file safely.
Two-step verification adds a second check after the password, such as an authenticator app code, a hardware security key or a prompt on a trusted device. The NCSC treats turning on 2SV as the first and most important step when you clean up password habits, because it blocks many attacks even after a phishing steal.
Prefer authenticator apps or security keys over SMS where you can. SMS still helps if nothing else is offered, but SIM swaps and message interception are known risks. Store backup codes offline in a safe place when a site provides them.
Enable 2SV on email before you reset other accounts. Then enable it on banking, cloud storage and social media. Work accounts may mandate a particular method; follow your organisation standard rather than inventing a parallel setup.
If you lose the phone that holds your authenticator, those backup codes or a registered hardware key are what get you back in. Test recovery once while you still have access. Print codes and put them with other important papers, or store them in an encrypted backup approved by your workplace.
Passkeys let you sign in with a cryptographic key unlocked by your device PIN, fingerprint or face check. You do not invent a new string, and a lookalike phishing site cannot easily collect a passkey the way it collects a typed password.
The NCSC recommends making passkeys your first choice where a site offers them, and keeping strong unique passwords plus 2SV everywhere else meanwhile. We explain the security model in plain language in Are passkeys safe?.
Register passkeys on more than one device or use a syncing platform you trust so you are not locked out when a phone is lost. Keep a recovery path documented. Passkeys reduce password burden; they do not remove the need for device security and account recovery planning.
Until every site supports passkeys, you will still need a manager. Treat passkeys as the preferred door on modern services and passwords as the fallback on older ones. When a site offers both, register the passkey and keep the password entry in your vault as a backup until you are confident recovery works.
Security questions are often weak because answers are public or shared within families. Where a site forces them, treat answers like additional passwords: long, unique and stored in your manager rather than truthful trivia.
Do not email passwords to yourself. Do not paste them into chat apps. Do not screenshot your vault. Do not share primary passwords with support callers who contact you first; real support will not need your full password in clear text.
You do not need a perfect score on day one. Unique email and banking credentials plus a manager already remove most of the everyday risk that comes from password reuse.
Families can share a short household checklist: who owns the manager subscription, where backup codes live, and which devices hold passkeys. Small businesses should separate personal and work vaults and follow any supplier requirements for multi-factor authentication.
If you already suffered account takeover, start with email recovery through the provider official help pages, then rotate passwords on every important site while logged in from a clean device. Scan for malware if the password was stolen from your computer rather than from a remote breach.
Teaching a relative? Sit with them while you install a manager and save the email password together. A thirty-minute setup beats another year of sticky notes on the monitor.
This article draws on NCSC top tips and widely discussed NIST SP 800-63B ideas without inventing numeric thresholds. Product interfaces change, so follow each provider current enrolment screens when you enable 2SV or passkeys.
Revisit the plan every few months when you get a new phone or laptop, and confirm passkeys and authenticator apps moved with you before you wipe the old device.
Make it long and unique. Use a password manager to generate a random password for each site, and a memorable multi-word passphrase for the manager and email.
A long random or Diceware-style passphrase is usually easier to remember and harder to guess than a short string with a few symbols.
Yes. The NCSC recommends password managers so you can use a different strong password on every account without memorising each one.
Your email password, because inbox access lets attackers reset other accounts. Keep it strong, unique and covered by 2SV.
Passkeys are designed to resist phishing and reuse problems that plague passwords. The NCSC recommends using them where they are offered.
It can be, if the paper is stored securely and you still use strong unique secrets. The NCSC notes this option for some situations, with clear cautions about access and phishing.
Change a password when there is a breach, reuse problem or suspected compromise. Forced regular changes without cause are no longer best practice in modern guidance such as NIST SP 800-63B.
Use a reputable password manager generator, or a trusted tool such as the password generator on mfaysal.com, then store the result in your manager.
Last checked: 18 October 2026. Rates and rules can change, so confirm anything important with the official GOV.UK or NCSC source linked above.
The UK government plans to stop under-16s using platforms such as TikTok, Instagram, Snapchat, YouTube, Facebook and X from spring 2027. Here is what the official fact sheet says, how age checks might work, whether adults will need to show ID, and what it means for developers and parents.
On 6 October 2026 ASOS app users received a push notification reading 'ASOS HACKED'. ASOS later confirmed attackers took customer profiles including names, addresses, phone numbers and emails, but not payment details or passwords. Here is a factual timeline and eight practical steps to stay safe.
Fingerprinting identifies your browser from dozens of small details, with no cookie to delete. Here is how it works (with a small tested demo), why "fingerprints are the new cookies" went viral this week, what the ICO says, and what actually helps: browsers, settings, VPNs and incognito.
A viral "Passkeys are a trap" post hit the top of Hacker News this week. Here is a balanced explanation of how passkeys work, why they stop phishing better than passwords, the genuine lock-in and attestation concerns, and how to use them without getting locked out.