Create Strong Passwords and Use a Password Manager
Weak or reused passwords are one of the biggest security risks there is. Here's how to create passwords that actually hold up — and the free tools that make it manageable.
On this page
The single biggest thing most people can do to improve their security is use strong, unique passwords for every account. It sounds like a lot, but with the right approach it's very manageable.
What Makes a Password Strong?
Modern guidance (from the US NIST, UK NCSC, and Canadian CRA) has shifted away from complex "P@ssw0rd!" style passwords. What actually matters is:
- Length: Longer is stronger. Aim for at least 12 characters, ideally 16+.
- Uniqueness: Every account should have a different password. If one site is breached, all your other accounts stay safe.
- Unpredictability: Avoid personal information — names, birthdays, favourite teams — that someone could guess.
A Simple Method: Passphrase
Pick four or five random words and join them: correct-horse-battery-staple is the famous example. It's long, memorable, and vastly harder to crack than "P@ssword1". Add a number and a symbol if the site requires it.
Why You Need a Password Manager
Nobody can remember a unique 16-character password for every site they use. A password manager does it for you — it stores all your passwords securely behind one master password, and can generate strong random passwords automatically.
Free options that work well
- Bitwarden — free, open-source, works on Windows, Mac, iOS, and Android. Highly recommended.
- KeePass — free and open-source, stores everything locally on your computer.
- Browser built-in managers — Chrome, Edge, Firefox, and Safari all have built-in password managers that sync across your devices. They're not as feature-rich but are far better than reusing passwords.
Getting Started with Your Browser's Password Manager
- In Chrome or Edge, go to the three-dot menu > Passwords (or Settings > Autofill > Password Manager).
- Turn on Offer to save passwords.
- Next time you log in somewhere, let the browser save it.
- For existing accounts with weak passwords, the manager will prompt you to update them.
Once you have a password manager in place, you can start going through your accounts and upgrading the weak ones. Focus first on email, banking, and any account where you can make purchases.
Frequently asked questions
Is it safe to let my browser remember my passwords?
Yes — for most people it's much safer than reusing weak passwords or writing them on paper. Browser password managers are encrypted and protected by your device login. The main risk is if someone else uses your computer without a separate user account. For extra security, set your browser to require your Windows Hello (fingerprint, PIN, or face) before filling passwords.
What should my master password for a password manager be?
Make it long and memorable — a passphrase of four or five random words works well. Write it down and keep it somewhere physically safe (like with other important documents), since there's usually no way to recover access if you forget it. Don't use it for anything else.
Comments & Questions (0)
No comments yet — be the first to ask. Comments appear after review.
Leave a comment
Your comment appears after our team approves it. Or sign in to post faster.