Secure password tips

Here are the tips in order of how much they help, and what has changed from the old rules.

1. Make it long

Length matters more than anything else you can control. NIST's password guidance (SP 800-63B-4) says a password used on its own should be at least 15 characters. If the password is only one part of a multi-factor login, 8 is the minimum it allows. NIST also asks sites to accept at least 64 characters, so long passphrases fit.

2. Make it random

People are predictable. We pick names, dates, teams and keyboard patterns, and we meet "add a capital and a number" rules in the same few ways. NIST's own example: someone who would have picked "password" picks "Password1", or "Password1!" when a symbol is required. Attackers try those patterns first.

The NCSC also warns that swapping letters for look-alike numbers, such as 0 for o, doesn't help much. Criminals know those tricks, and the swaps make the password harder for you to remember.

The fix is to let a random source choose. A generator picks every character or word with equal odds, so there's no pattern to guess.

3. Use three or more random words if you need to remember it

For the few passwords you have to type from memory, use words. The NCSC's advice is three random words joined together, like their example "applenemobiro". The result is long, hard to guess and easy to remember.

Words you choose yourself are less random than they feel, so let a generator pick them. With a 7,776-word list such as EFF's, each random word adds about 12.9 bits of strength (log2 of 7,776). Three words give about 39 bits, four about 52 and five about 65. EFF suggests six words, about 77 bits, for most uses. Every extra bit doubles the number of guesses needed.

The generator below starts on five random words. Switch to characters for passwords you'll only ever paste.

4. Never reuse a password

When one site leaks its passwords, attackers try the same email and password on other sites. NIST calls these "password stuffing" attacks. A different password for every account stops one leak from opening the rest.

Your email password matters most. The NCSC points out that whoever gets into your email can reset the passwords of your other accounts. Give your email a strong password you use nowhere else.

5. Keep them in a password manager

Nobody can remember dozens of long random passwords, and you don't need to. A password manager stores them, fills them in and can make them for you. NIST tells sites to allow password managers and pasting, and notes that people with password managers choose stronger passwords. The NCSC encourages them too.

You then need to remember one strong passphrase, for the manager itself. Make that one five or six random words.

If you'd rather write a password down, the NCSC says that's OK, as long as you keep it somewhere safe.

6. Turn on two-step verification

Even a perfect password can be stolen by a fake login page or malware on your device. Two-step verification (2SV, also called two-factor or multi-factor authentication) means a stolen password isn't enough on its own. The NCSC recommends it especially for email. An authenticator app or a security key is the better choice: NIST classes codes sent by text message or phone call as a "restricted" method, and lists risks such as SIM changes and number porting.

What you can stop doing

• Changing passwords on a schedule. NIST tells services not to force periodic changes, only a change when there's evidence a password was exposed.
• Following "one of each" rules for their own sake. NIST tells services not to impose composition rules such as a required mix of character types. A long random password is strong without them, though some sites still demand them.
• Security questions and password hints. NIST says sites shouldn't prompt for security questions when you choose a password, or let you store a hint that others can see. Where a site still insists, treat the answer like a password: a random one, saved in your password manager.

How long should a random password be?

For random characters, 15 is the minimum and 20 is a comfortable default. A 20-character password from upper and lower case letters, digits and symbols has about 128 bits of strength, far beyond what anyone can guess. If a site rejects symbols, turn them off and add a few characters.

If you'll read a password aloud or type it from a screen, use the human-readable password generator, which leaves out look-alikes like 0 and O. For a passphrase in the style of the famous comic, try the xkcd password generator.