How to Create Strong Passwords and Manage Them Securely

Strong passwords that actually hold up in 2026

A client emailed me last month, slightly panicked. Someone had logged into their webmail from a city they'd never visited, tried to change the recovery address, and failed only because the backup code went to a phone that was sitting on their desk. They got lucky. The password on that account was Dog2019! — eight characters, one capital, one symbol. On paper, it ticked the boxes. In practice, a cracking rig chews through that in under an hour.

That's the gap most advice ignores. Complexity rules were written for a world where attackers guessed slowly. That world is gone. What matters now is length, uniqueness, and where you store the thing — in that order. If you get those three right, you can stop losing sleep over whether your password has a special character in position four.

What is the best way to create a strong password?

The best method is to generate a long random string and let software remember it. That's the honest answer, and it's also the one people resist because it feels like giving up control. I resisted it too. For about two years I kept a mental system where I'd swap the vowels in a base word and append the site's initials. I thought I was clever. Then I ran a free audit tool that checks whether your email appears in known breach dumps, and the results were sobering: four of my accounts, all using variants of the same base, showed up in leaked credential lists.

Length matters more than complexity

Every extra character multiplies the number of guesses an attacker needs. Going from eight characters to sixteen doesn't double the work — it multiplies it by a factor in the hundreds of millions. That's the whole game.

Which means a phrase like correct-horse-battery-staple is genuinely stronger than X7$kL!2m, even though the second one looks scarier. The first is 28 characters of lowercase words. The second is eight characters of chaos. Guess which one takes longer to break.

Here's a rule of thumb I use with clients:

• Anything under 12 characters: replace it today.
• 12 to 16 characters: acceptable for low-value accounts.
• 16+ characters, randomly generated: this is where you want your email, banking, and cloud storage.
• Passphrases of four to six random words: excellent for anything you must type by hand.

Why password reuse is the real killer

Attackers don't crack your password and stop. They take the email-and-password pair, then try it against Gmail, then against your bank, then against every e-commerce site they can automate. This is called credential stuffing, and it works because roughly a third of people reuse the same password across multiple accounts.

I once helped a small business owner untangle a mess where a single leaked password on a defunct forum from years ago had unlocked his accounting software. The forum no longer existed. The password did, and it was doing damage.

One password, one account. No exceptions.

What are some ideas for strong passwords?

Two approaches work, and they serve different situations.

Random generation: best for accounts you never type

If a password manager fills it in, you never need to see or remember it. Generate something like mK9#vL2$pQ7@xR4!nT8&wZ3 and move on. It's ugly. That's fine. Ugly is the point.

Passphrases: best for the few you must memorize

You'll have maybe three passwords you actually type: your manager's master password, your computer login, and your phone unlock. For those, use a passphrase of random words joined by a separator.

velvet-otter-canyon-brick — four words, 27 characters, easy to visualize, hard to crack.

giraffe-trombone-sandal-pluto-mango — five words, ridiculous, memorable, very strong.

The trick is randomness. Don't build it from a sentence that means something to you. "I love my dog Rex" produces ilovemydogrex, which is a dictionary attack waiting to happen. Pick words that have no relationship to each other or to you.

A few guidelines that keep coming up when people ask me for examples:

1. Never use a word that appears on your social media profile — pet names, kids' names, sports teams.
2. Avoid keyboard walks: qwerty, asdfgh, 123456.
3. Skip the classic substitutions. Password crackers know that "a" becomes "@" and "o" becomes "0".
4. Don't append the year or a single "!" to a weak base. Every cracking tool checks those first.
5. If it's easy to remember because it's meaningful, it's easy to guess.

What is the best way to secure my passwords?

Use a password manager and turn on two-factor authentication everywhere it's offered. That's the entire answer, and everything else is detail.

The manager question

I've moved between three different password managers over the years, mostly out of curiosity, and I've settled on one principle: the best manager is the one you'll actually use. Fancy features mean nothing if you abandon it after a week.

Manager	Model	Strengths	Watch out for
Bitwarden	Open source, free tier	Generous free plan, self-hosting option, transparent code	Interface is functional rather than polished
1Password	Closed source, paid	Best-in-class design, strong family and team sharing	No permanent free tier
KeePass	Open source, offline	You hold the database file, no cloud dependency	Syncing across devices is on you
Dashlane	Closed source, paid	Built-in VPN and dark web monitoring	Bundled extras you may not want
Your browser	Built-in	Zero setup, works everywhere	Locked to one ecosystem, weaker sharing

My own setup: Bitwarden for everything, a hardware security key for the master account, and a printed recovery code locked in a drawer. That last part matters more than people realize. A manager with no recovery path is a single point of failure.

Rotation and breach checks

You don't need to change passwords every 90 days. That advice is outdated and mostly produces weaker passwords because people increment a number at the end. What you should do instead is check your credentials against known breach data — several managers build this in, and there are free web tools that do it too. If an account shows up, change that one password immediately.

Every few months, I run this check across my main accounts. It takes about two minutes. Twice in the past year it caught credentials I'd forgotten were still active on services I no longer used.

Which password manager is the best in 2026?

For most people, Bitwarden is the best combination of price and capability. The free tier handles unlimited passwords and devices, the code is open for anyone to inspect, and it supports passkeys, secure sharing, and emergency access. If you want something more polished and don't mind paying annually, 1Password is the stronger product for families and teams managing shared credentials.

If you prefer to keep everything local and control your own backups, KeePass remains the choice for the technically comfortable. There's no company holding your vault because there's no company at all.

What I'd avoid: any manager that's been abandoned by its developers, and any "free" service that monetizes your data. Read the privacy model before you trust a vault with your entire digital life.

Passkeys, and the part nobody tells you

Passkeys replace the password entirely. Instead of a shared secret, your device holds a private key and proves possession to the site using cryptography. Nothing to phish, nothing to reuse, nothing to crack.

I've been migrating accounts to passkeys as the option appears. Gmail, GitHub, and most major banks now support them. It's not seamless — some sites still fall back to a password, and you need a recovery method if you lose the device. But it's the direction everything is heading, and adopting early means fewer credentials in circulation.

Where a passkey is offered, take it. Where it isn't, use a long unique password stored in your manager plus two-factor authentication. That combination covers almost everything a normal person will ever face.

The uncomfortable truth is that most breaches don't involve clever hacking. They involve a password that was reused, guessed, or leaked years ago and never changed. Fix that, and you've removed the easiest way in.