Most accounts aren’t broken into by clever hackers. Passwords are guessed, reused from another site that was leaked, or simply asked for by a scammer. The good news: a few simple habits protect you from almost all of it. Here’s how to make strong passwords, remember them, and keep your accounts safe.
What makes a password strong
- Length. Every extra character makes a password much harder to guess. Use at least 12 characters, ideally 16 or more.
- Randomness. Names, birthdays, NIC numbers, phone numbers and words like “password” are the first things attackers try.
- Uniqueness. A different password for every account. When one website leaks, the others stay safe.
| Password | Verdict |
|---|---|
| kamal1995 | Weak: a name and a birth year are guessed in seconds |
| Password@123 | Weak: one of the most common patterns there is |
| Colombo2026! | Weak: place, year, symbol is a pattern attackers try early |
| mango river lamp seventeen | Strong: four random words, long and easy to remember |
| tq8#Vm2!pL9z@Rw4 | Strong: 16 random characters, best kept in a password manager |
Two easy ways to make one
1. Let a generator pick it. The Password Generator makes a random password using your browser’s secure random numbers. Choose a length of 16 or more and tick capital letters, small letters, numbers and symbols. Tick “avoid look-alike characters” if you’ll ever need to type it by hand.
2. Make a passphrase. Pick four or five random, unrelated words, like “mango river lamp seventeen”. It’s long, so it’s strong, and it’s much easier to remember than a jumble of symbols. Don’t use a famous quote or song line: those are guessable.
How to remember them all
Nobody can remember 30 different random passwords, and you don’t need to. Use a password manager. One is already built into your phone and browser: Google Password Manager on Android and Chrome, and Passwords (iCloud Keychain) on iPhone. It saves each password when you sign up and fills it in for you. You only need to remember the one password for your Google or Apple account, so make that one excellent.
If a password manager feels too complicated, a notebook kept safely at home is still far better than using the same password everywhere.
Turn on two-step verification
Two-step verification asks for a second proof, usually a code sent to your phone, when someone signs in from a new device. Even if your password leaks, the attacker can’t get in. Turn it on for your email first (it can reset every other password), then Facebook, Instagram and banking apps. In WhatsApp, go to Settings → Account → Two-step verification and set a PIN.
Common questions
How often should I change my passwords?
Only when there's a reason: a website reports a leak, you shared it, or you think someone knows it. Changing strong passwords on a schedule tends to make people choose weaker ones.
Is the password generator safe to use?
Yes. Passwords are made on your device with your browser's secure random number generator. They are never sent or saved anywhere.
Can I use one strong password everywhere?
No. If any one site leaks it, attackers try it on your email, Facebook and bank. Use a different password for each account.
Are symbols really necessary?
Length matters more. A long passphrase of random words is stronger than a short password full of symbols. Add symbols when a website requires them.