How to Create Strong Passwords and Protect Your Online Accounts

What makes a password strong

Length and unpredictability matter most. A long random password is usually stronger than a short clever phrase with a single number at the end. Avoid names, birthdays, phone numbers, and common keyboard patterns.

Uniqueness matters just as much. If one site is breached and you reused that password elsewhere, attackers try the same login on email, banking, and shopping sites.

Passphrases versus random strings

A passphrase made of several unrelated words can be easier to remember for a few critical accounts, as long as it is long and not a famous quote. For most accounts, a random generated string stored in a password manager is simpler.

Do not “clever-up” a base password by changing one character per site. Attackers know those patterns.

Generate instead of inventing

Invented passwords tend to follow human habits. A generator removes that bias. Try our Password Generator to create long random passwords you can copy into a manager.

Generate a fresh password whenever you create an account or respond to a suspected leak. Do not recycle the old one with a year suffix.

Use a password manager

A reputable password manager stores unique passwords behind one strong master password (and, ideally, device authentication). It autofills the right login on the right site, which also helps you spot fake pages that do not match.

Back up recovery methods according to the manager’s guidance. Losing access to the vault without a recovery plan can lock you out of many services at once.

Add a second factor wherever you can

Turn on two-factor authentication (OTP apps, hardware keys, or SMS where nothing else exists) for email, banking, and major shopping accounts. Email is especially important because password resets flow through it.

Prefer authenticator apps or security keys over SMS when available. Keep backup codes offline in a safe place.

Habits that quietly weaken security

Sharing OTPs on phone calls, saving passwords in plain browser notes on shared computers, and logging into banking on public devices are common risks. Log out of shared systems and avoid “remember me” on devices you do not control.

If a site emails you about a reset you did not request, change that password from a device you trust and check email account security next.

A practical upgrade plan

This week: install or set up a password manager, create a strong master password, and move your email login first. Next: banking and UPI-linked accounts. Then update shopping and social logins as you use them.

Pair this with broader habits in online privacy basics so passwords are not your only defence.

• Long, random, unique passwords.
• Generator + password manager.
• Two-factor on email and finance.
• No reuse across important sites.