Strong passwords and password managers

You need only three or four passwords in your head. A password manager can make and remember the other hundred.

The real danger is reuse

Websites are broken into all the time, and their lists of emails and passwords are traded. Criminals then try each pair on banks, email, shopping and social sites automatically. This is called credential stuffing. If your shopping password is also your email password, a leak at a small shop opens your mailbox, and your mailbox resets everything else.

So the first rule is not "make it complicated". It is: a different password for every account that matters.

What makes a password strong

• Length beats tricks. Each added character multiplies the guesses needed. Twelve characters is a sensible minimum; sixteen or more for the accounts that matter most.
• Unpredictable. Not a name, a date, a phone number, a keyboard row, a film, or any of these with "@123" on the end. Guessing programs try all the usual patterns first, including "P@ssw0rd"-style swaps.
• Unique. Used in one place only.

Rules that force a capital, a number and a symbol do not make a short, predictable password strong. "Rahul@1995" obeys them all and is guessed in moments.

A passphrase you can remember

For the few passwords you must type from memory, string together four or five unrelated words: for example a fruit, a tool, a colour, a place and a number that is not a date. Unrelated words chosen at random are long, easy to picture and hard to guess. Do not use a line from a song, a proverb or a film title. Our password generator makes random passphrases and passwords on your own device.

Which passwords deserve a place in your memory:

1. your phone's screen lock;
2. your main email;
3. your password manager;
4. perhaps your computer login.

Let a password manager do the rest

A password manager is a locked vault that creates a long random password for each site, saves it, and fills it in for you.

• Built in: Google Password Manager (Android and Chrome) and Apple's Passwords (iPhone, iPad and Mac) are free and already on your device.
• Stand-alone: established apps that work across every system. Choose one with a long record and independent security audits.

Benefits beyond memory: a manager fills a password only on the site it was saved for, so it will refuse a look-alike phishing page; and it warns you about passwords that are reused or found in leaks.

Protect the vault itself with a strong passphrase and two-step verification, and keep its recovery kit or backup codes on paper.

What about writing passwords down?

A notebook kept at home is safer than reusing one password everywhere, and suits many older people. It does not travel with you and can be lost in a fire or found by a visitor. Never keep the list in an unlocked note on the phone, in an email to yourself, or in a file called "passwords".

Habits

• Change a password when there is a reason: a leak, a suspicious login, or after sharing it. Changing all passwords every few months only leads to weaker ones.
• Never share a password by chat or on a call. Staff of banks and companies do not need it.
• Security questions: treat the answers as passwords. Your mother's maiden name and first school are known to many.
• PINs: avoid birth years, 1234, 0000, 1111 and repeating patterns. Do not use the same PIN for the ATM card, the phone and UPI.
• Do not save passwords in a browser on a shared or office computer.
• Add a second step wherever it is offered, and a passkey where available.