How to Create and Manage Strong Passwords
Strong account security starts with unique passwords and a realistic way to manage them.
Length matters more than clever substitutions
A long random password has a much larger search space than a short password decorated with predictable substitutions. For important accounts, use at least 16 characters. Randomly generated passwords of 20 characters or more are a sensible default when a service allows them.
Use a unique password for every account
Password reuse turns one breach into many compromised accounts. Attackers test leaked email and password combinations against other services automatically. A unique password limits the damage to the service where the original exposure occurred.
Store passwords in a password manager
People are not good at remembering dozens of random strings. A reputable password manager creates, stores and fills unique credentials. Protect the manager with a strong master passphrase that you do not use anywhere else. Keep recovery information in a safe offline location.
Enable multi-factor authentication
A second factor adds protection when a password is stolen. Authenticator apps and security keys are generally stronger than SMS, although any available second factor is usually better than none. Save recovery codes before you need them.
Generate passwords locally
The ZT4 password generator uses the browser cryptographic random source and does not upload the result. Generate a new value for each account and move it directly into your password manager.
A simple security checklist
- Use 16 or more characters.
- Never reuse a password.
- Store credentials in a password manager.
- Turn on multi-factor authentication.
- Change exposed credentials immediately after a breach notice.