Creating and Remembering Strong Passwords

Most password advice you’ve heard — capital letter, number, symbol, change it every 90 days — actually makes passwords harder to remember and not much harder to crack. Here’s what actually works.

What makes a password strong

Length matters far more than complexity. correct-horse-battery-staple (28 characters, easy to remember) is dramatically harder to crack than P@ssw0rd1! (10 characters, the kind of pattern attackers check for first).

A few unrelated words strung together — a passphrase — gives you both: long enough to be strong, and easy enough to actually remember without writing it down.

Caution

Never reuse a password across different accounts. If one site is ever breached, attackers try that same email/password combination everywhere else — reusing passwords turns one leak into many.

Why you don’t need to remember them all

You’re not expected to memorise a different strong passphrase for every account — that’s what a password manager is for. It generates a unique, strong password for every site, remembers it for you, and fills it in automatically. You only need to remember one master password to unlock the manager itself.

Ask support which password manager is provided for company use, and use it for work accounts at minimum.

What to do instead of changing your password on a schedule

Forcing regular password changes usually makes things worse — people tend to make small, predictable tweaks (Password1 becomes Password2) rather than genuinely new ones. Change your password when:

• You suspect it’s been seen by someone else.
• You’ve been notified of a breach involving an account using that password.
• Support asks you to, following a security incident.

Combine it with MFA

A strong password is your first layer, not your only one. Wherever it’s offered, turn on multi-factor authentication (MFA) — ideally a passkey or YubiKey, which is stronger again than a text-message code.