Key takeaways
- CISA says a strong password is long, random and unique, with at least 16 characters, and a different one for every account.
- A password manager can create and store these for you, so you only need to remember one strong password.
- Don’t use easy-to-guess passwords such as 12345 or ones based on birthdays or pet names, and don’t reuse passwords.
- Turn on multifactor authentication too, especially for email, social media and financial accounts.
This article is general information based on US government guidance. It can’t guarantee your accounts won’t be hacked.
Why weak passwords are a problem
CISA, the US cybersecurity agency, says simple passwords such as 12345, or ones made from common personal details like birthdays and pet names, “are not safe for protecting important accounts.” It compares an easy-to-guess password to “locking the door but leaving the key in the lock.” Weak passwords can be broken quickly by computer hackers.
Reusing a password is a risk too. CISA tells a story of a person whose bank and email accounts used the same password. When that password turned up in a company data breach posted online, both accounts were taken over. CISA’s older guidance puts it this way: reusing a password, even a strong one, “endangers your accounts just as much as using a weak password.”
The three rules of a strong password
CISA says a strong password follows all three of these tips.
1. Make it long. At least 16 characters. “Longer is stronger.”
2. Make it random. CISA offers two ways:
- A random string of mixed-case letters, numbers and symbols.
- A “passphrase” of 4 to 7 unrelated words. CISA’s example of a good one is “HorsePurpleHatRun,” a better one adds a fifth word, and a longer one is better still. You can use spaces between words.
3. Make it unique. Use a different strong password for every account.
CISA’s older guidance adds that you should avoid words found in any dictionary, personal information that’s easy to find or guess, common phrases, famous quotations and song lyrics.
Why you need a password manager
CISA is blunt: “it’s impossible to remember a unique strong password for every account.” Its advice is to use a password manager, which it describes as “an easy-to-use program that generates, stores and even fills in all your passwords.” CISA says managers can also warn you about weak or reused passwords. With a manager, you only need to remember one strong password, the one for the manager itself. CISA suggests making that a long, memorable passphrase.
CISA says there are many to choose from. Some are free, such as the built-in password managers in web browsers, and some cost money. It suggests searching a trusted source such as Consumer Reports for highly rated ones and reading reviews. We don’t recommend a particular product here.
How to protect your passwords
CISA’s older guidance has these tips:
- Don’t write passwords down and leave them in your desk, next to your computer or stuck to a screen.
- Don’t tell anyone your passwords, and be wary of calls or messages asking for them. See our guide to spotting a phishing email.
- Log out on shared computers, such as at a library or office, and avoid public computers and public Wi-Fi for sensitive accounts such as banking and email.
- Know your browser settings. Depending on how your browser saves passwords, anyone with access to your computer may be able to see them.
CISA adds that “there’s no guarantee that these techniques will prevent an attacker from learning your password, but they will make it more difficult.”
Add a second step
CISA says to turn on multifactor authentication (MFA) as well, “especially for your email, social media accounts and financial accounts.” Even a strong password can be stolen. For how to turn it on, see our guide to two-factor authentication.
Check the sites you use
CISA suggests checking whether your email, bank, healthcare provider and other important accounts enforce strong password rules. If a site lets you use a short password or a dictionary word, CISA says to ask them why.
A quick checklist
- Each important account has its own long, random password (16 characters or more)
- A password manager creates and stores them
- The manager’s own password is a strong passphrase
- MFA is on for email, social media and financial accounts
- I don’t reuse passwords or write them down where others can see
- I log out of shared and public computers
Frequently asked questions
How long should a password be? CISA’s current tips say at least 16 characters. Older CISA guidance, based on NIST, suggests using the longest password the site allows.
Is a passphrase better than random characters? CISA lists both as good ways to make a random password, as long as it’s long and unique.
Is it safe to keep all my passwords in one place? CISA recommends password managers and says to protect the manager with a strong password and MFA. We haven’t compared products.
Should I let my browser save passwords? CISA says browser managers are one free option, but warns that anyone who can use your computer may be able to see saved passwords, depending on settings.
Information checked on: October 31, 2026. Guidance changes, so check CISA’s current pages.
Sources
- CISA, Use Strong Passwords (labelled “Archived Content” on the page)
- CISA, Choosing and Protecting Passwords (revised November 18, 2019; labelled “Archived Content” on the page)