Strong passwords and password managers: where to start

Start with your email. Build better habits as you sign in.

The answer in 2 lines. Use a passkey where the service offers one: this is the current recommendation from the National Cyber Security Centre. Where you still need a password, make it unique and hard to guess, and enable two-step verification. A password manager can generate and remember passwords. Begin with your email because it is often used to reset other accounts. You can improve accounts gradually, but act promptly if a password has been exposed.

Start with your important accounts

Secure email: follow the NCSC email guidance and replace any reused password with a separate one.
Use passkeys when offered: open account security settings and follow the service’s setup instructions. For a worked government example, see GOV.UK’s passkey instructions.
Protect remaining password accounts: use the NCSC setup guide to enable two-step verification.

Stop: danger

Unexpected login approval request: do not approve it. Open the account independently and review its security. The NCSC account-protection guidance explains why an unexpected request can mean someone knows your password.
Someone asks for a password or verification code: do not disclose it to the caller or message sender, even if they claim to be helping.

Create something memorable without making it predictable

The NCSC’s random-word method combines three unrelated words to make a longer password. Choose your own words rather than copying a published example. Avoid names, birthdays, favourite teams, familiar sayings and details visible on your social profiles.

Follow any requirements imposed by the account, but do not rely on changing a letter into a symbol to rescue an obvious choice. For accounts you do not need to memorise, let a password manager generate an independent password. Adding a website’s name to the same base password leaves a predictable pattern.

Password managers: choose something you can use reliably

Use the NCSC password-manager guide to compare your needs: supported devices, password generation, synchronisation, recovery and cost. A manager built into your own device or browser can be a practical starting point; a separate application may suit mixed devices.

Before committing, check how to unlock the manager and recover access. Protect its account with a strong, separate primary password where required and enable two-step verification. Keep devices updated and locked. Avoid saving passwords on public computers or devices other people can freely access.

What not to do

Reusing your email password for shopping, social accounts or the password manager.
Installing a security application from an unexpected message or pop-up.
Saving passwords in the browser on a library or other public computer.
Removing an existing sign-in method before understanding how you would recover access.

Add protection and plan for recovery

Two-step verification adds another check beyond a password. Follow the NCSC instructions: find security settings, look for two-step verification, two-factor authentication or multi-factor authentication, and follow the options offered.

Check that recovery contact details belong to you and remain accessible. If the service supplies recovery codes, follow its storage instructions and keep them somewhere you can reach if your usual device is unavailable. Think through that situation before signing out. The GOV.UK passkey guide also explains the device screen-lock requirement for that service.

If a password has already been stolen

Follow the NCSC hacked-account guide. Go directly to the provider’s genuine recovery pages if you cannot sign in. Once access is restored, check for unfamiliar security changes and replace passwords shared with other accounts.

If money is missing, contact your bank immediately and use Report Fraud’s crime reporting route for England. Do not assume changing a password resolves an unauthorised payment. This reporting route also covers Wales and Northern Ireland; Scottish incidents follow the police route stated on that page.

Good to know

Passkeys are the NCSC’s preferred option where available; its 2026 announcement explains their resistance to phishing.
Autofill can help recognise the correct website. If it unexpectedly fails, check the address before typing a password manually.
These security principles apply across the UK. Account settings and recovery options depend on the service, so read its instructions before making changes.

Illustrative example: George in Bristol has reused a password for years. He secures his email first, enables an extra verification step and checks recovery details. As he next uses other accounts, he replaces reused passwords with generated ones or sets up passkeys where offered. He checks he can access the saved credentials on his own devices.

A made-up story, for illustration.

Bobby

Sources, verification, confidence

Verified on 6 November 2026, for England. Confidence: high for unique passwords, random-word passwords, password managers, two-step verification and the current preference for passkeys. Exact setup and recovery options vary by service. No commercial product is recommended.