What makes a strong password?
Reviewed by Hritik, White Fortress Academy · last reviewed 2026-11-11
Length and uniqueness matter more than tricky symbols. A long passphrase of several random words, used for one account only and backed by multi-factor authentication, is far stronger than a short password with a few substitutions.
What to do
- Use at least 12 characters. Longer is better.
- Prefer a passphrase of four or more random, unrelated words.
- Use a different password for every account.
- Keep them in a password manager so you do not have to remember each one.
- Turn on MFA wherever it is offered.
- Avoid names, birthdays, keyboard patterns and common passwords such as “123456” or “password”.
Common mistakes
- Reusing one password on many sites, so one leak opens them all.
- Adding “1!” to a short word and calling it strong.
Questions people ask
Why are passphrases a good idea?
Each extra random word multiplies the guesses an attacker needs, while a phrase is easier to remember than random symbols.
Do I need to change my passwords often?
Not on a fixed schedule. Change one when you suspect it has leaked, when a service reports a breach, or when you find you have reused it.
Also in the arcade: Password Fortress, a password strength game for students. Terms: mfa. All quick answers · IT glossary
Plain-English guide by White Fortress Academy.