How to Create Strong Passwords and Use a Password Manager

Most people know they should use strong, unique passwords. Most people also have a confession: they don’t. They reuse the same two or three passwords across dozens of accounts, maybe adding a number or an exclamation mark at the end when a website insists. It’s completely understandable. Nobody can remember fifty different complicated passwords.

The problem is that reused passwords are one of the main ways accounts get hacked. When a website suffers a data breach, criminals collect the leaked emails and passwords and try them on other services automatically. If you used the same password on your email, your bank or your social media, those accounts are suddenly at risk, even though you did nothing wrong on those sites.

The good news is that there’s a simple solution: let a password manager remember your passwords for you. In this guide, we’ll explain what makes a password strong, how password managers work, which built-in options your phone already has, how to set one up step by step and how to gradually fix your old, weak passwords without spending a whole weekend on it.

You do not need to be a security expert to do this well. The steps in this guide are designed for everyday people who want their accounts to be safer without turning password management into a full-time job.

What makes a password strong?

A strong password has three qualities:

• Long. Length is the single most important factor. A password of 15 characters or more is much harder to crack than a short one, even if the short one has symbols.
• Unique. It’s used for only one account. If one site is breached, your other accounts stay safe.
• Unpredictable. It doesn’t include your name, birthday, pet’s name, favorite team or common words in obvious patterns.

Examples of weak passwords

• Simple sequences like 123456 or qwerty.
• Common words with small changes, like Password1!
• Personal information, like your name followed by your birth year.
• The same password reused with a different number at the end.

Two good approaches

Random passwords generated by a password manager, like a long mix of letters, numbers and symbols. You don’t need to remember them, because the manager does.

Passphrases made of several random words, like four or five unrelated words joined together. They’re long, hard to guess and much easier to remember and type. Passphrases are ideal for the few passwords you need to remember yourself, such as your password manager’s main password or your computer login.

A useful way to compare the two approaches: a random password is like a key cut by a machine, impossible to copy by guessing but not something you would memorize. A passphrase is like a long sentence you know by heart, easy for you and still very hard for anyone else. Use machine-cut keys for almost everything, and keep one or two memorable sentences for the few places where you need to type from memory.

When creating a passphrase, choose words at random rather than a famous quote, a song lyric or a phrase from a movie. Attackers know those too. Picking words by opening a dictionary at random pages, or letting your password manager generate a passphrase, produces much stronger results.

Why reusing passwords is so dangerous

Imagine you used the same password for a small online shop and for your email. The shop gets hacked, and its customer database is leaked. Criminals now have your email address and password. They don’t need to hack your email provider. They simply log in.

This technique, called credential stuffing, is automated and happens on a massive scale. It’s why security experts consider unique passwords more important than complicated rules about symbols and uppercase letters.

You can check whether your email address has appeared in known data breaches using reputable breach notification services, and many password managers now include this check automatically. If your email shows up, do not panic. It simply means it is time to make sure the passwords linked to it are unique and strong.

How a password manager works

A password manager is an app that stores all your passwords in an encrypted vault. You unlock the vault with one strong main password, or with your fingerprint or face on your phone.

Once it’s set up, a password manager can:

• Generate strong, unique passwords for new accounts.
• Save passwords automatically when you log in or sign up.
• Fill in usernames and passwords on websites and apps.
• Sync your passwords across your phone, tablet and computer.
• Warn you about reused, weak or leaked passwords.
• Store passkeys, a newer passwordless way to sign in.

You only need to remember one password, and the manager takes care of the rest.

People often worry that putting all their passwords in one place is like putting all their eggs in one basket. The difference is that this basket is a locked, encrypted safe protected by a strong passphrase and a second factor. Compare that with the alternative, reusing a few simple passwords everywhere, and the safe basket wins easily.

Built-in options: you may already have one

Before installing anything, check what your phone already offers.

Google Password Manager on Android

Android phones come with Google Password Manager, tied to your Google account. It saves passwords in Chrome and in many apps, fills them in automatically and syncs to any device where you’re signed in to Google. It also includes a Password Checkup that flags compromised, reused and weak passwords.

You can find it in Settings, under Google, then Autofill, then Google Password Manager, or by searching for Password Manager in Settings. Many Android phones also let you add it as a shortcut on your home screen.

Apple Passwords on iPhone

On iPhone, iPad and Mac, Apple’s password manager, known as iCloud Keychain, stores your passwords and passkeys. On recent versions of iOS, they’re available in the dedicated Passwords app. It generates strong passwords when you create accounts in Safari and apps, fills them in with Face ID or Touch ID and syncs across your Apple devices. It also warns you about reused and compromised passwords.

Independent password managers

If you use a mix of devices, such as an iPhone with a Windows PC, or if you want features like secure sharing with family, an independent password manager can be a better fit. Well-known options include Bitwarden, 1Password and others. They work across Android, iPhone, Windows, Mac and major browsers. Some offer free plans, while others require a subscription.

Which should you choose?

• All Apple devices: Apple Passwords is simple and works well.
• Android plus Chrome on your computer: Google Password Manager is a natural choice.
• Mixed devices or family sharing: an independent password manager is often the most flexible.

The best password manager is the one you’ll actually use consistently.

It is also worth thinking about what happens if something happens to you. Some password managers offer emergency access features, letting a trusted family member request access to your vault after a waiting period. Setting this up is a thoughtful step that can save your loved ones a great deal of stress in a difficult moment.

Password managers also protect you from phishing in a subtle way. Because they fill in passwords only on the exact website where they were saved, a fake login page with a slightly different address will not get your password automatically. If your manager refuses to fill in a password on a page that looks familiar, stop and check the address carefully.

How to set up a password manager step by step

Step 1: Choose your main password carefully

If your password manager uses a main password, make it a long passphrase of several random words that you can remember. Don’t reuse it anywhere else. Write it down and store the paper somewhere safe at home while you memorize it.

Step 2: Turn on two-factor authentication

Protect the account that holds your passwords, whether it’s your Google account, Apple account or password manager account, with two-factor authentication. We have a separate guide on setting up two-factor authentication on your most important accounts.

Step 3: Turn on autofill

On Android: go to Settings, search for Autofill or Passwords and autofill, and choose your preferred password manager as the autofill service.

On iPhone: go to Settings, then General, then AutoFill and Passwords, and turn on autofill for your chosen password manager.

Step 4: Import or save existing passwords

Many password managers can import passwords saved in your browser. Otherwise, they’ll offer to save each password the next time you log in to a site or app.

Step 5: Install it on your other devices

Install the app or browser extension on your computer and tablet, and sign in. Your passwords will sync everywhere.

Take your time with the main password. It is the one password worth spending a few minutes on. Practice typing it several times over the first week until it becomes automatic. Once it is in your muscle memory, you will barely think about it again.

Fixing old passwords without the overwhelm

You don’t need to change every password in one day. Use a gradual approach.

1. Run a password check. Google Password Checkup, Apple Passwords’ security recommendations and independent managers all show compromised, reused and weak passwords.
2. Fix compromised passwords first. Any password that appeared in a known breach should be changed immediately.
3. Then fix your most important accounts: email, phone account, banking, password manager, social media and shopping accounts with saved payment methods.
4. Fix the rest as you go. Each time you log in to a site and your manager flags a weak or reused password, change it to a generated one. Over a few weeks, your whole collection improves without a big effort.

If you have hundreds of accounts, consider starting with the ones you use every week. Those are the passwords you type most often, so updating them quickly gets you used to letting the manager fill them in. Older accounts you rarely visit can wait until the next time you need them, or you can delete those accounts entirely if you no longer use them.

Passkeys: the future of signing in

Passkeys are a newer alternative to passwords. Instead of typing a password, you sign in with your phone’s fingerprint, face or screen lock. Passkeys are unique to each website, can’t be reused and are resistant to phishing, because they only work on the real site.

Google Password Manager, Apple Passwords and many independent managers support passkeys. When a website or app offers to create a passkey, it’s usually worth accepting. You can keep your password as a backup while you get used to it.

As passkeys spread, you will notice more websites offering them during login or in account security settings. Adding a passkey usually takes a few seconds: confirm with your fingerprint or face, and you are done. The next time you sign in, there is nothing to type and nothing for a phishing site to steal.

Common password mistakes to avoid

• Writing passwords in a notes app or sending them to yourself by email or chat.
• Saving passwords in a screenshot in your gallery.
• Sharing passwords by text message. Use your password manager’s sharing feature instead.
• Ignoring breach warnings. If your manager says a password was leaked, change it.
• Answering security questions truthfully. Answers like your mother’s maiden name or first school can often be found online. Treat security answers like extra passwords and store random answers in your password manager.
• Logging in on shared computers without signing out and without using private browsing.

If you share accounts with family, such as streaming services or a household utility account, use the sharing features in your password manager instead of sending passwords in messages. Shared items stay encrypted, update automatically when the password changes and can be removed when someone no longer needs access.

Another subtle mistake is keeping old accounts you no longer use. Every forgotten account with a reused password is a potential weak point. When your password manager shows you accounts you do not recognize or no longer need, consider deleting them through the website account settings. Fewer accounts means fewer things to protect.

Frequently asked questions

Is it safe to store all my passwords in one place?

With a reputable password manager, yes. Your vault is encrypted, and protected by a strong main password and two-factor authentication. It’s far safer than reusing passwords or writing them in unprotected notes.

What happens if I forget my main password?

It depends on the manager. Built-in options use your Google or Apple account recovery. Some independent managers can’t recover a forgotten main password because they don’t know it. Set up recovery options and keep a written copy somewhere safe at home.

Are browser password managers good enough?

For many people, yes. Google Password Manager and Apple Passwords are secure and convenient. Independent managers add cross-platform flexibility and advanced features.

How long should a password be?

Aim for at least 15 characters for important accounts. Password manager generated passwords are often longer, which is fine since you don’t type them yourself.

Should I change my passwords regularly?

Security experts now generally recommend changing passwords when there’s a reason, such as a breach, rather than on a fixed schedule. Strong, unique passwords don’t need constant changes.

Are passkeys replacing passwords?

They’re becoming more common, and many major services support them. Passwords will likely remain for a while, so a password manager that handles both is ideal.

Final thoughts

Strong, unique passwords are one of the best protections you can give your online life, and a password manager makes them effortless. Start with the one built into your phone or choose an independent manager if you use mixed devices, protect it with a strong passphrase and two-factor authentication, and fix your most important passwords first. Within a few weeks, you’ll have stronger security than most people, without having to remember anything more than one good passphrase.

Start today with three small steps: turn on the password manager built into your phone, change the password on your main email account to a generated one, and turn on two-factor authentication for that account. Those three actions alone dramatically improve your security, and everything else can follow at your own pace.