How to create a strong password

Most password advice people remember — "use a capital, a number and a symbol", "change it every month" — turned out to make passwords harder to remember without making them much harder to crack. The advice below follows the NCSC, the part of GCHQ that publishes the UK's official guidance for the public.

What makes a password strong?

Criminals rarely guess passwords one at a time by hand. They use software that tries enormous lists of likely passwords: ones leaked in previous data breaches, dictionary words, names, dates, keyboard patterns, and all the usual tweaks people make to them. A password is strong if it isn't on those lists and can't be reached by working through them. That comes down to two things:

• Length. Every extra character multiplies the number of possibilities. A long password made of simple parts beats a short one stuffed with symbols.
• Unpredictability. Anything linked to you — your children's names, your football team, your birthday, your pet — is often findable on social media, and it's the first thing an attacker tries.

There's a third rule that matters even more: never reuse a password. When one website is breached, attackers try the leaked email and password combinations on other sites. If you've used the same password elsewhere, one breach unlocks every account that shares it.

The "three random words" method

The NCSC's headline advice is to create a password by stringing together three random words. It's long enough to resist guessing, and far easier to remember than Tr0ub4dor&3-style gibberish.

1. Pick three words that are random to you. Look around the room, open a book at a random page, or use a generator. kettle, purple, horizon.
2. Don't make them a phrase. Song lyrics, film quotes and well-known sayings are exactly what cracking software checks. "Random" means the words don't belong together.
3. Join them up. kettlepurplehorizon. If a website insists on a capital, number or symbol, add them — Kettlepurplehorizon7! — but the NCSC is clear that you don't need to make a password complicated to make it strong.
4. Skip the clever substitutions. Swapping o for 0 or a for @ doesn't fool anyone; the software tries those automatically.

Three random words are ideal for the few passwords you genuinely have to type from memory: your email, your computer or phone, and your password manager.

Common password myths

Let a password manager do the remembering

A unique password for every account is impossible to memorise, and the NCSC's answer is to stop trying. A password manager — a dedicated app, or the one built into Chrome, Edge, Safari or Firefox — creates strong passwords, stores them, and fills them in for you. The NCSC points out some useful side effects:

• It only autofills on the genuine website, which helps protect you against phishing pages that look like the real thing.
• It syncs across your devices, so a strong password is no harder to use on your phone than on your laptop.
• Many warn you if a saved password has turned up in a known breach.

The NCSC says saving passwords in your browser is safe on your own devices, as long as you keep automatic updates switched on. Don't save them on a shared or public computer, like one in a library. Protect the password manager itself with three random words and 2-step verification.

Protect your email first

If you only fix one password today, make it your email. Almost every other account lets you reset its password by email, so whoever controls your inbox can take over the rest. Give it a strong password you use nowhere else.

Turn on 2-step verification, and use passkeys where you can

2-step verification (2SV) asks for a second thing, like a code from an app or a text, when you log in from somewhere new. Even if your password is stolen, the attacker is stuck without it. Switch it on for email, banking and social media first.

Passkeys go a step further: instead of a password, you sign in with your phone or computer's fingerprint, face or PIN, and there's nothing to guess, reuse or type into a fake site. The NCSC now recommends making passkeys your first choice wherever a service offers them.

Generating a password: random characters or a passphrase?

For passwords that live in a password manager, you never have to type or remember them, so let a generator create them. Altto's Password Generator offers both styles, using your browser's built-in cryptographic randomness, and runs entirely on your device:

• Random characters pack the most strength into the fewest characters. With all four character types on, each character adds just over 6 bits of randomness, so the default 16 characters gives roughly 100 bits — far beyond what guessing can reach. This is the best choice for anything stored in a password manager.
• Passphrases (like Tiger-Meadow-Amber-47) are easier to read out or type on a phone. Altto picks each word from a deliberately short, simple list of 256 words, so each word adds exactly 8 bits. That's less per word than words you'd choose from your whole vocabulary, so use more of them: seven or more words is where its strength meter shows Strong.

Whichever you use, the same rule holds: one password, one account.

Common questions