How to choose passwords worth having

Most password advice people were given for years — mix upper and lower case, add a number, throw in a symbol — turned out to produce exactly the kind of password that is easy to forget and, for a computer trying to guess it, not especially hard to find. The advice that actually holds up is simpler than that, and mostly comes down to two things: length, and never reusing the same password anywhere else.

Length matters more than complexity

A longer password is harder to guess by brute force than a shorter one stuffed with symbols, simply because the number of possible combinations grows enormously with each additional character. A long passphrase built from several unrelated words is both easier for a person to remember and harder to guess than a short string forced to include a capital letter, a digit and a symbol, which people predictably satisfy in the same handful of predictable ways — a capital at the start, a digit at the end, an exclamation mark instead of the letter i.

Reuse is the actual weakness

The single biggest practical risk with passwords has very little to do with how strong any individual one is. It is reuse. When one service is compromised and its stored passwords are exposed, attackers do not stop at that one service — they try the same email and password combination against every other service they can think of, because reuse is common enough that it works often enough to be worth the attempt automatically, at scale, without any specific targeting of you personally.

A single strong, memorable password, reused across a dozen accounts, is weaker in practice than a dozen different, unremarkable passwords, because it takes only one of those dozen services having a bad year to compromise every account you share it with.

Use a password manager rather than trying to remember it all

The practical solution to needing a different, long password for every account is not memorising more — it is not needing to. A password manager generates and stores a unique, long password for every site, and the only password you actually need to remember is the one that unlocks the manager itself. This turns "different password for everything" from an unrealistic burden into something that requires no ongoing effort at all.

Where this matters most for a website you run

For anyone running a website, a handful of specific passwords deserve particular attention because compromising any one of them gives an attacker meaningful reach:

• Your control panel password — access to the account managing hosting, domains and email for the site.
• Your CMS administrator password — direct access to content, plugins, and often the ability to add further admin accounts.
• Your database password — direct access to everything stored by the site, including, on many platforms, other users' data.
• Email account passwords — since email is usually the account used to reset every other password, compromising it can cascade into everything else.

None of these should be shared with any other account anywhere, including each other.

Add two-factor authentication rather than relying on the password alone

Even the strongest password is a single piece of information, and single pieces of information leak — through a data breach at an unrelated service, a phishing page, or malware on a shared device. Two-factor authentication adds a second, independent check, so a leaked password alone is not enough to get in. How to turn on two-factor authentication covers enabling it on your control panel and CMS accounts.

Checking whether a password has already been exposed

Data breaches at unrelated services regularly expose large numbers of email and password combinations, and several reputable services let you check whether a specific password has appeared in a known breach without meaningfully exposing the password itself, typically by checking only a partial cryptographic hash rather than transmitting the password in full. If a password you currently use anywhere turns up in such a check, treat it as compromised and change it, regardless of how strong it otherwise looks — a long, well-constructed password that has already been exposed in a breach offers no more protection than a short one, since an attacker working from breach data is trying the exact known value rather than guessing.

What does not actually help

Forcing a password change on a fixed schedule for an account that has not shown any sign of compromise mostly encourages small, predictable variations on the same underlying password rather than genuinely new ones — changing "Autumn2025!" to "Autumn2026!" does not meaningfully improve anything. A long, unique password left in place indefinitely, protected by two-factor authentication, is a stronger position than a shorter one rotated on a schedule out of habit. Change a password when there is an actual reason to — a suspected leak, a shared device, a service reporting a breach — rather than on a routine you keep out of habit alone.