6 Tips for Creating Super-Strong Passwords

2. Embrace variety

Never repeat the same password, even if it’s super strong like f!P%^&TRf04. If you use the same password on multiple accounts and your system is breached, cybercriminals not only know your password but also can figure out all the sites and apps you visit.

Also avoid using repetitive letters or numbers to make a password longer. Password may be weak, but so is paaaassword. Sequential numbers and letters, such as qwerty, the top row of letters on an English-language keyboard, have the same problem. Don’t add the next four letters either: qwertyuiop.

3. Use at least 12 characters, including your keyboard’s special characters

At least 12 characters is ideal; 20 characters is even better. 

Don’t limit yourself to lower- and uppercase letters and numerals. You can use punctuation marks and other symbols to make it a lot less likely that a criminal will guess your combination (think &, @, $, etc.). 

Some can work as replacements for letters. For example, D0m8inma$ter@ for “domain master” or G00denuf!1 for “good enough.” Have fun with it.

4. Opt for a passphrase to create a longer, more memorable password

A passphrase can be easier to remember than random mixed characters. It can be a sequence of at least four words without spaces and something meaningful to you, such as myb!rDP0lly#1!, which loosely translates to “my bird Polly is No. 1.”

5. Consider a passkey for verification

A passkey verifies an app or website user through biometrics, such as a fingerprint or facial recognition, using a PIN or swiping to create a pattern. The method uses two keys, one that resides on the app or website and the other through the device accessing it.

• Apple syncs its passkeys through its iCloud Keychain, a built-in password manager that allows user access on any Apple devices.
• Google has passkeys through its Chrome browser and Android phones, synced to Google Password Manager.
• Microsoft offers logins without passwords for Windows users to sign into Microsoft accounts using their face, fingerprint or PIN.

Also possible: A physical security key to log into important accounts.

6. Change your passwords periodically

Cybersecurity experts remain divided on the ideal frequency of modifying passwords, but most suggest every three months. Set a calendar reminder or think about it as part of your routine when the seasons change. If your account has been involved in a data breach or has been compromised in any way, of course, change it immediately.

This story, originally published Jan. 3, 2023, was updated with new password tips, statistics and advice.