6 Steps to Help You Create Strong Passwords

More than three-quarters of 2,000 respondents to a survey released in June admit they use the same password to log into more than one account, according to Forbes Advisor and Talker Research, formerly OnePoll.

Also avoid using repetitive letters or numbers to make a password longer. Password may be weak, but so is paaaassword. Sequential numbers and letters, such as qwerty, the top row of letters on an English-language keyboard, have the same problem. Don’t add the next four letters either: qwertyuiop.

3. Use your keyboard’s special characters

The National Institute of Standards and Technology recommends passwords of at least eight characters, but that’s a low bar for hackers to crack. At least 12 characters is ideal; 20 characters is even better.

While most people won’t go this far, the agency says website passwords could be as long as 64 characters. That’s when a password manager would be helpful.

When configuring a password, don’t limit yourself to lower- and uppercase letters and numerals. You can use punctuation marks and other symbols to make it a lot less likely that a crook will guess your combination:

• ampersand &
• asterisk *
• at sign @
• brackets, open [ or close ]
• caret ^
• dollar sign $
• equal sign =
• greater than >
• less than <
• plus +
• slash, forward / or back \
• tilde ~

Some can work as replacements for letters. For example, D0m8inma$ter@ for “domain master” or G00denuf!1 for “good enough.” Have fun with it.

Not all websites accept all special characters. But they often tell you which ones you can use.

4. Opt for a passphrase to create a longer password

A passphrase can be easier to remember than random mixed characters. It can be a sequence of at least four words without spaces and something meaningful to you, such as myb!rDP0lly#1!, which loosely translates to “my bird Polly is No. 1.”

Some people create such a phrase using association techniques. Think of the site you’re visiting and create a password that relates to the service, perhaps Ih8tethisb&nk$! for “I hate this bank” or N3v3rsh0ph3r3ag8in$ for “never shop here again.”

The National Institute of Standards recommends longer passphrases even if you don’t include the complexity of special characters.

What you’re trying to do is turn the odds more in your favor when hackers try to guess your password. Think of this particular game like a lottery you don’t want them to win. Add more balls to the pool with special characters or increase the number of balls drawn with length, and possible combinations turn exponentially against the criminals. 

Want to geek out on the odds? A hacker has a roughly 1 in 1.2 trillion random chance of figuring out your password if you’re using eight characters with only digits and lowercase letters. The numbers are high because what you type is in a specific order, but the bad guys don’t do this manually. If you use a 12-character password and expand your choices to include capital letters and the special characters listed above, the odds of landing on the correct 12-character combo increase to 1 in almost 15 sextillion, as in add 21 zeros on the end. 

5. Consider a passkey for verification

A passkey verifies an app or website user through biometrics, such as a fingerprint or facial recognition, using a PIN or swiping to create a pattern. The method uses two keys, one that resides on the app or website and the other through the device accessing it.

• Apple syncs its passkeys through its iCloud Keychain, a built-in password manager that allows user access on any Apple devices.
• Google now has passkeys through its Chrome browser and Android phones, synced to Google Password Manager.
• Microsoft offers logins without passwords for Windows users to sign into Microsoft accounts using their face, fingerprint or PIN.

Also possible: A physical security key to log into important accounts.

6. Accept help from your web browser

If you make your password too simple, you may find websites reject your choice and request you to try again. That’s because a data breach for you also has consequences for them.

Browsers such as Google Chrome, Apple Safari, Microsoft Edge and Mozilla Firefox have built-in password managers and will prompt you to let them generate complex passwords for you. Most commercial password manager apps, such as subscription-based 1Password, Bitwarden, Dashlane, Keeper Security and LastPass, have the same feature.

If you worry you may be caught up in a data breach, trusted resources such as haveibeenpwned.com and Cybernews’ data breach lookup can help. Type in your email or phone number to check if you’ve been exposed.

This story, originally published Jan. 3, 2023, was updated with new password tips, statistics and advice.