Strong passwords: how to create them and choose a password manager

You do not need to memorize every password. You need a reliable way to keep each one different.

The answer in 2 lines. Make passwords long, unpredictable and unique to each account. A password manager can generate and store them, leaving you with fewer secrets to remember. Start with your email and the accounts that control your money or personal records. Enable multifactor authentication wherever available. For a practical walkthrough, use NIST's password guide and apply its advice when choosing or replacing your passwords. Never reuse a password printed in an example.

Make a manageable start

Secure your main email: choose a unique password, check your recovery information and enable multifactor authentication in the account's security settings.
Replace reused passwords: prioritize financial accounts and accounts containing sensitive records. Let a password manager generate a different password for each.
Plan for recovery: understand how to regain access to your password manager before relying on it for important accounts. Store recovery information securely.

Stop: danger

Keep codes private: never read a verification code to someone who unexpectedly contacts you.
Reject surprise approval requests: do not approve a sign-in you did not initiate.
Pause at unexpected login links: open the account through its established app or by entering the known website address yourself.

Build a password you can actually use

For a password you must remember, a passphrase made from unrelated words can provide length without relying on predictable substitutions. Avoid familiar quotations, personal details, keyboard patterns and small variations of an old password. A public example is already known, so create your own.

For the other accounts, use a password manager's generator rather than inventing a pattern based on the website's name. Follow any restrictions the account imposes without shortening the password unnecessarily.

The NIST authentication guidelines published in 2025 require at least 15 characters when a password is the sole authentication factor in covered systems. Search the document for its password requirements to see the scope. These technical guidelines do not mean every consumer website must follow an identical federal password rule.

What not to do

Using the same password with a different ending for each account.
Keeping a plain-text password file in shared or easily accessible storage.
Installing a password manager from an unexpected message or advertisement without verifying its source.
Treating a password manager as a guarantee that every page or message is safe.

Choose a password manager without chasing a brand

Read the FTC's account-protection guide to compare the basic approaches: saved passwords in a browser or a separate password manager. Use its advice as a starting point, then check the candidate's current documentation.

Check	What to establish before relying on it
Devices	Can you access your credentials on the devices and browsers you actually use?
Security	How is the vault protected, and can you enable multifactor authentication?
Recovery	What happens if you forget the main password or lose your phone?
Maintenance	Is the software actively maintained, with a clear update process?
Practical use	Can you generate, save and retrieve a password confidently?

Test the workflow with a less sensitive account before moving your essential logins. Choose a unique main passphrase and follow the documented recovery setup.

Add protection beyond the password

Multifactor authentication adds a further check when you sign in. In each account's security settings, review the methods offered and complete the setup, including recovery options. Do not assume that saving a password automatically enables this protection.

The FBI's online safety guide explains strong passwords, multifactor authentication and passkeys. Use its account-security sections to review your setup. Where available, a passkey can replace a password; check how it works across your devices and how you would recover access before switching.

Change a password if it was exposed, shared with a scammer or used on a compromised account. Replace reused copies elsewhere too. If you suspect a takeover, use the account's verified recovery process rather than a link supplied by an unsolicited helper.

Good to know

NIST's 2025 guidance rejects routine password changes without evidence of compromise for covered systems; a workplace may still impose its own policy.
Long passwords still need to be unpredictable. Repeating an obvious word does not solve the problem.
You can improve gradually: make each replacement unique instead of creating another temporary shared password.

Alex has reused a password across shopping and email accounts. He chooses a password manager, checks its recovery instructions and secures its vault. He replaces his email password, enables multifactor authentication and then generates unique passwords as he visits other accounts. He keeps recovery information somewhere secure and checks that he can retrieve his saved credentials.

A made-up story, for illustration.

Bobby

Sources, verification, confidence

Verified on November 5, 2026, for the United States. Confidence: high for password uniqueness, password managers and multifactor authentication; medium for product-specific features and recovery options, which vary. NIST's 2025 technical requirements are not presented as a universal consumer law.