How to choose strong passwords and use a password manager

Most account takeovers do not involve clever hacking. Someone reuses a password that leaked from another site, or picks something guessable, and an attacker simply tries it. Good password habits are one of the highest-value security steps you can take, and a password manager makes them almost effortless.

What makes a password strong

Strength comes from being hard to guess, not from looking complicated. Attackers use two main methods:

  • Guessing from lists. They try common passwords, names, dates and patterns, including clever variations like P@ssw0rd!. These are tried first and fall in seconds.
  • Credential stuffing. They take email and password pairs leaked from one site and try them on others. If you reuse a password, one breach opens many accounts.

So the real rules are simple:

  1. Make it long. Length beats complexity. A passphrase of four or five random words is easier to remember and harder to crack than a short jumble of symbols.
  2. Make it random. Do not use names, birthdays, pets, favourite teams or keyboard patterns.
  3. Make it unique. Never use the same password on two sites.

Passphrases for the few you must remember

You need to memorise only a few: your password manager's master password, your device login and your email. Use a passphrase of random words, for example:

teapot-orbit-lantern-velvet-mango

Choose the words truly at random, not from a favourite quote. Adding a number or symbol is fine but not essential. A long one like that would take impractically long to guess.

Use a password manager

Nobody can remember a unique, long, random password for every account. A password manager does it for you:

  • It generates strong random passwords.
  • It stores them in an encrypted vault.
  • It fills them in on the right sites, which also helps defeat fake login pages, because the manager will not fill a password on a lookalike domain.
  • It syncs across your devices.

You remember one strong master password, and the manager remembers the rest.

Choosing one

Look for a well-established product with a good security record, strong encryption, support for two-factor authentication on the vault itself and apps for your devices. Some are free, some paid, and some browsers include a basic one. Pick the one you will actually use consistently.

Setting it up well

  1. Create a long, unique master password that you have never used elsewhere.
  2. Turn on two-factor authentication for the manager.
  3. Save the recovery information somewhere safe and offline. Without it, a lost master password can mean lost data.
  4. Import or add your accounts gradually. Start with email, banking, your hosting account and anything that controls money.
  5. Replace weak and reused passwords, starting with the most important accounts.

Add a second factor

A password alone is a single lock. Two-factor authentication adds a second check, such as a code from an app. Even if a password leaks, the attacker still cannot get in. Turn it on for your email first, then everywhere that offers it, including your hosting account. See Enable two-factor authentication.

Prefer an authenticator app or a hardware key over text messages, because phone numbers can be hijacked.

Protect the accounts that unlock others

Your email account is the master key: password resets for nearly everything go there. Give it your best password and two-factor protection. The same goes for your hosting account, since it controls your servers. For help, see Keep your account secure and, if something goes wrong, Recover your account and Reset your password.

Things to avoid

  • Writing passwords on sticky notes near your computer.
  • Sharing passwords over chat or email. Where sharing is needed, use sub-users with limited permissions, as in Add and remove subusers, or the manager's sharing feature.
  • Saving them in a plain text file or a spreadsheet.
  • Using security questions with real answers. Treat the answers like passwords: make up random ones and store them in the manager.
  • Typing passwords on a link from a message. Go to the site yourself. See Spot phishing and fake support messages.
  • Reusing the master password.

Servers have passwords too

The same ideas apply to your servers. Use SSH keys instead of passwords where possible, and give every database and panel account its own strong password. See How to set up SSH key authentication and Basic security for a new VPS. Keep bot tokens and API keys out of public code, as described in Create and use API keys.

When a password leaks

If you learn that a site you use was breached, change that password at once, and anywhere else you reused it. Many managers include a checker that flags compromised or reused passwords. Check your email address on a reputable breach-notification service now and then.

Checklist

TaskDone?
Password manager installed
Strong master passphrase
Two-factor on the manager
Email account secured
Hosting account secured
Reused passwords replaced
Recovery information stored safely

Ten minutes of setup replaces years of low-level worry, and makes you a far harder target.

Still stuck? Open a ticket on Discord - run /ticket in any channel, pick a department, and include your Server ID or Invoice ID so we can jump straight in.