Imagine an online shop tells you your login details have been leaked. Unpleasant, but manageable: you change your password and monitor your account. But what if you also used the same combination for email, a social network and a booking app? An attacker does not need to do any complicated guessing. They simply try the leaked email and password pair elsewhere.
That is why password security does not start with finding one perfectly memorable string of characters. It starts with deciding not to use the same password in more than one place.
Why one “good” password is not enough
A leaked password may not be your fault. A service where you have an account could be breached, or you might enter your password on a convincing fake page. If you also use it elsewhere, the problem can spread quickly. Email is especially sensitive: anyone who gains access to it can try to reset access to other accounts.
Small variations such as “MyPassword1” for one website and “MyPassword2” for another do not help either. If a person can see the pattern, an attacker can recognise it too. A sensible goal is simple: every important account has its own password that you never use anywhere else.
What a strong password should look like
Length and uniqueness come first
A short password with one capital letter, a number and an exclamation mark may look “complex”, but it is often just a predictable pattern. Sufficient length and unpredictability matter more. NIST's guidance emphasises longer passwords and does not support mandatory combinations of character categories as a universal solution. For accounts protected only by a password, it specifies at least 15 characters; individual services may have their own technical limits.
For a password you need to remember, a longer phrase made from randomly chosen words can help, avoiding names, birthdays and well-known quotations. For other accounts, it is more practical to let a password manager generate a long random combination. You do not have to memorise it or copy it from a piece of paper.
Important: length does not replace uniqueness. A long password used on ten websites puts all ten at risk after a single leak.
When to change a password
Changing every password on a schedule every few months often leads only to small, predictable tweaks. NIST does not recommend requiring regular password changes without a reason. Change a password if it appears in a leak, you entered it on a suspicious page, someone else may have obtained it or you see an unfamiliar login. Used it elsewhere too? Change it on every affected account, using a different replacement each time.
What a password manager does and how to use it safely
A password manager is a protected vault for your login details. You remember how to access the vault, while it stores unique passwords for each service, can generate them and often offers to fill them in when you sign in. This means you do not have to choose between security and memory. A password manager can be built into your browser or operating system, or be a standalone application. When choosing one, consider device synchronisation, export options and secure account recovery.
One master password for the vault protects many other accounts. Create a long, unique passphrase that you do not use anywhere else, and enable multi-factor authentication if the manager offers it. Prepare a way to recover access too: securely stored backup codes or the provider's emergency procedure. Do not keep these only inside the vault that you would be unable to access without them.
Even a password manager has its limits. If someone gets hold of an unlocked device, access to your main account or persuades you to enter your details on a fraudulent website, your account may be at risk. Keep devices updated and, when using autofill, check that you really are at the right address. A password manager is a very useful habit, not a magic shield.
When BOIT's password generator can help
Need a new password without dreaming up another variation of your favourite word? Open the BOIT password generator. Set the length and choose whether the combination should include capital letters, numbers and special characters. Then generate a password for a specific account. You will also find a link to the tool in our tools overview.
Start with a length the service allows, and use the resulting password for one account only. The best place to store it is a password manager. A generator creates a new combination; a manager handles the everyday use of dozens of different combinations. If your manager has its own generator, you can follow the same process directly in it.
Do not put passwords in public posts or email them to yourself as a backup. And whenever you use a web-based generator, check that you are at the tool's correct address.
A password is not your last layer of protection
Enable multi-factor authentication for your email, password manager, bank and other important accounts. After you enter your password, the service then requires an additional confirmation, such as one in an authenticator app. It is not infallible: a fraudulent page may also try to trick you into giving up a one-time code. Even so, it is another obstacle for someone who only knows your password.
Where a passkey is available, consider that option too. It lets you sign in using a key stored on your device or in a credential manager, usually confirmed with a PIN or biometrics. When used correctly, it is tied to a specific website, making it more resistant to fake login pages. Remember to find out in advance how to recover access if you lose your device. NCSC explains passwords and password managers.
How to get started in one evening
You do not have to change everything at once. Secure your email and password manager account first, then your bank, social networks and services where you have a card saved. Give each a unique password, enable additional authentication for important accounts and save your recovery codes. You can gradually update the remaining accounts the next time you sign in.
A good password is not one you can recite from memory after a week. It is one nobody can easily guess, that works nowhere else and that you can access securely when you need it.
Back to all articles