A strong password is long, unique to one account, and hard for someone else to guess — and a passkey is a newer option that replaces the password altogether on services that support it. You need one good method for creating passwords, a password manager to remember them, and two-factor authentication on the accounts that matter most.
What makes a password strong
Length matters more than clever symbols. A password of 14 or more characters, built from three or four random words that mean nothing to anyone else, is far harder to crack than a short one with a capital letter and an exclamation mark, and it is usually easier to remember too.
Use a different password everywhere it matters
Reusing a password turns one leak into many. When a website is breached, the passwords from that breach are tried on other services within hours, so a breach at a shop can become a breach of your inbox, and from there a reset of your banking password.
You do not have to memorise them all. A password manager stores a different, random password for every site and fills it in for you, so you remember one strong master password and it remembers the rest. Our pillar article on how to stay safe online: the habits that actually protect you explains where to start if you are tightening up several accounts at once.
Passkeys, in plain English
A passkey is a way to sign in without typing a password at all. When you create one, your device stores a private key and the website stores a matching public key. To sign in, you confirm it is you — with a fingerprint, a face scan, or your device PIN — and the two keys match. There is nothing to type, nothing to remember, and nothing for a phishing message to steal, because there is no password to hand over.
Passkeys are now offered by many large services, usually under security or sign-in settings. The main trade-off is that they live on your devices, so create one on a second device while you still have the first, and keep your recovery options up to date. If you are moving to a new handset, our article on move to a new phone covers transferring accounts safely.
| Option | What you remember | Main strength |
|---|---|---|
| Long password plus password manager | One master password | Works everywhere, unique per site |
| Passkey | Nothing — fingerprint or PIN | Nothing to type or steal by phishing |
| Password plus two-factor authentication | Password plus a code | A stolen password alone is not enough |
Changing passwords and checking for leaks
Many password managers warn you if a saved password has appeared in a known breach. Take those warnings seriously for email and banking, and change the affected passwords promptly. Our article on how to spot phishing messages before you click shows how to check scam messages, and our piece on how to keep your kids safer online covers passwords for younger family members.
Key takeaways
- Length beats clever symbols — aim for 14 or more characters, built from random words.
- Use a different password for every important account, and let a password manager remember them.
- A passkey replaces the password entirely, and there is nothing for a phishing message to steal.
- Turn on two-factor authentication for email, banking, and cloud storage.
- Change a password when there is a reason, not on a fixed schedule.
Frequently asked questions
What is the best way to create a strong password?
Join three or four random words together and add a number in a place only you would choose, aiming for 14 or more characters in total. Avoid names, birthdays, and favourite teams, which are easy to guess.
Are passkeys safer than passwords?
For services that support them, yes. A passkey cannot be guessed, reused, or stolen through a fake sign-in page, because there is no password to type. Set one up on a second device too, so a lost phone does not lock you out.
Do I need a password manager?
It helps a lot once you have more than a handful of accounts. A manager creates and stores a different random password for every site, so you only need to remember one strong master password.
How often should I change my passwords?
Change one when a service reports a breach, when you notice strange activity, or when you realise you reused it elsewhere. Regular forced changes often lead to weaker passwords, not stronger ones.
Passwords are not glamorous, but the choice is simpler than it looks. Pick a method you will actually use, make every important password unique, and let your phone or a manager do the remembering.
