A strong account password should be difficult to guess and unique to that account. The simplest reliable workflow is to generate it with a trusted password manager or generator, save it immediately, and never reuse it elsewhere. A strength meter can point out obvious weaknesses, but it cannot guarantee a particular crack time or protect an account from phishing and service breaches.
Start with the account’s actual requirements
Check the service’s current rules before generating a value. Some systems have maximum lengths, reject certain characters, or mishandle pasted passwords. Use the longest password the service reliably accepts, and prefer a password manager’s built-in generator when possible because it can save the result directly to the matching login.
Do not invent a “complexity recipe” from memory, such as always adding one symbol and changing a to @. Predictable substitutions and common patterns appear in guessing dictionaries. A randomly generated string or a sufficiently long randomly selected passphrase is less dependent on a person’s habits.
Generate a different password for every account
Reusing a password creates a chain reaction: if one service is breached and a password becomes known, attackers may try the same email and password on other sites. A unique password limits that reuse risk. Create a separate value for each account, including the email account used to reset other logins.
For a new login:
- Open the intended service directly, not through a password-reset link in an unexpected message.
- Generate a password using a password manager or a reputable generator with a clear handling model.
- Save it to the correct account entry before leaving the page.
- Submit it, then sign out and sign back in once if practical to confirm the saved credential works.
- Add multifactor authentication where the service supports it, especially on email, financial, administrator, and recovery accounts.
If you use a standalone web generator, consider whether the password is created locally or sent to a server. Look for a clear privacy explanation and avoid pasting passwords into an online strength checker. A local generator still depends on the integrity of the browser, device, and page; for high-value credentials, a maintained password manager is usually the simpler choice.
How to evaluate a password without exposing it
Start with structural questions rather than uploading the secret to a website:
- Is it unique to this account?
- Was it generated randomly or assembled from predictable personal details?
- Is it long enough for the site and password manager to handle reliably?
- Is it stored in a password manager rather than a note, screenshot, or reused memory phrase?
- Is multifactor authentication available for the account?
A strength estimator can flag common words, repeated patterns, short length, or predictable substitutions. Its score depends on its model and assumptions about an attacker. It does not know whether the exact password has appeared in a breach, whether the service stores passwords safely, or whether a phishing page captures it. Never paste a real password into an untrusted checker to get a score.
If you use a checker, test a made-up example with similar structure instead of the live credential. Some tools process locally, but verify the tool’s stated behavior and the page’s source before relying on that claim. Toolsnix offers a Password Generator and Password Strength Checker; follow each page’s current privacy notes and do not enter a password you actively use.
Random passwords and passphrases
A password manager can create a random sequence of letters, numbers, and symbols. It is suitable when the manager fills the value for you. If you need to type a password manually, a passphrase made of randomly selected words may be easier to transcribe, provided it has enough independently selected words and is not a familiar quotation or personal phrase.
The number of possible combinations depends on how the value was selected, not merely its visual variety. A short phrase from a song is easier to guess than a longer sequence of randomly selected words, even if the lyric contains punctuation. Do not add predictable personal facts such as a pet’s name, birthday, employer, or favorite team.
For accounts, the choice is secondary to uniqueness and safe storage. For a device you must unlock frequently, a passphrase may be convenient if the device’s policy allows it. For a service stored in a manager, a random generated string is usually easier because you rarely need to memorize it.
Store and recover it safely
Use a password manager with a strong, unique master password and a recovery plan you understand. Secure the manager account with multifactor authentication where available. Keep recovery codes in a separate protected place that you can access if the device is lost.
Avoid storing credentials in plain text, shared documents, screenshots, chat messages, or source code. Do not send a password to a colleague when an account-sharing feature or delegated access is available. If multiple people need access, create individual accounts and assign only the necessary permissions.
Before replacing an old password, confirm you can reach the account’s recovery email and phone number. Update recovery details from the service’s official site. An inaccessible password manager with no backup plan can lock you out even when each individual password is strong.
When to change a password
Change it when you have a reason: a service reports a breach, you receive a credible exposure notice, you shared it with someone who should no longer have access, or you entered it into a suspicious site. Also change it if you discover reuse. Routine calendar changes without a threat can encourage weaker variations, such as appending a year.
If you suspect compromise, use a trusted device and go directly to the service. Change the password, revoke active sessions if the service offers that control, review recovery methods and connected apps, and enable multifactor authentication. Changing a password does not necessarily invalidate every existing session or API token, so inspect the account’s security settings.
NIST’s digital identity guidance is a useful technical reference for authenticator practices, but each service may apply its own rules. See NIST SP 800-63B and check the service’s current policy.
Check the account’s recovery path
A password protects one sign-in route; recovery settings can provide another way into the account. Review the recovery email address, phone number, authenticator methods, trusted devices, and active sessions. If an attacker controls the recovery email, a strong site password alone may not protect the account.
For important accounts, secure the email account first because it often resets other passwords. Use unique credentials for email, password manager, cloud storage, and financial services. Store recovery codes according to the service’s instructions, and keep them somewhere different from the device that normally signs you in. If the service supports passkeys or hardware security keys, read its recovery process before relying on them as your only method.
Avoid creating a recovery path that silently defeats your main protection. For example, a weak shared inbox or a phone number that has not been updated can make account recovery unreliable. The right setup depends on the service and your threat model; document how you would regain access if your phone or laptop were lost.
Use a safe replacement sequence
If you are changing a password after suspected exposure, start from a device you believe is trustworthy and navigate to the service directly. Change the credential, then review security activity, sign out unknown sessions, and revoke tokens or app passwords you no longer recognize. Some services keep existing sessions active after a password change, so look for a separate “sign out everywhere” control.
Do not change a password by following an unsolicited link in a message. Phishing pages often imitate password reset flows. If you clicked a suspicious link and entered a credential, treat it as exposed: reset it at the genuine service and check the account’s recovery and session settings.
If the same password was used elsewhere, change each affected account to a different value. Prioritize accounts that can reset or access other services. A credential manager can help track which logins have been updated without keeping a list of passwords in a plain document.
Keep usability in the security decision
A security rule that people cannot follow often leads to workarounds. If a service blocks password managers, has a tiny maximum length, or strips pasted characters, report the problem and use the strongest unique credential the service accepts. Do not create a scheme of predictable variations to satisfy an arbitrary rotation prompt.
For a shared household or team account, prefer individual accounts and delegated access. If sharing is unavoidable, use the password manager’s secure sharing feature, limit membership, and rotate access when a person leaves. Sending the value through email or a chat channel creates additional copies and makes revocation harder.
Decide what to do with old credentials
After creating a new password, remove obsolete copies from plain-text notes and shared devices. If a password was reused, create a unique value for each affected account rather than changing only the account where you first noticed the problem. A password manager’s duplicate-password report can help prioritize, but review its findings carefully.
If an account supports passkeys, hardware security keys, or an authenticator app, consider enabling them alongside the unique password. These controls address different risks and depend on the service’s implementation. Keep a recovery method that you can access without weakening the account’s main protection.
FAQs
How long should my password be?
Use a password manager’s recommended length within the service’s current limits. Longer randomly generated values generally provide more possible combinations, but no single length guarantees safety across every threat model.
Is a password with symbols always stronger?
Not by itself. Length and unpredictability matter. A short predictable pattern with symbols can still be guessed; a longer random value can be harder to guess.
Can I use the same strong password on two accounts?
Avoid it. Uniqueness helps contain damage if a service exposes a password. Let a password manager create and store a separate credential for each account.
Should I trust an online password strength checker?
Only after checking how it handles input, and never with a password you currently use unless you have strong evidence that the check is local and appropriate. A score is an estimate, not a guarantee.
What if a site will not accept my generated password?
Check its documented character and length limits. Generate a new unique value within those constraints, save it, and report the issue to the service if the allowed range is unusually restrictive.
Next step
Generate one unique password, save it in your password manager, and enable multifactor authentication for the account. If you are replacing an exposed password, review sessions and recovery options as well as the password itself.