A strong password is long, random and different for every account. The trick to remembering it is a passphrase: several unrelated words strung together.
- Make it long. CISA recommends at least 16 characters. Longer is stronger.
- Make it random. Use a passphrase of 5 to 7 unrelated words strung together. Skip birthdays, pet names and "12345".
- Make it unique. Use a different password for every account, so one leak doesn't unlock the rest.
- Store them in a password manager. CISA recommends keeping your long, random, unique passwords in one, so you don't have to remember them all.
Never give your password to someone who calls, texts or emails you out of the blue, even if they say they're from a company you know.
If that didn't work: Gave a password to a scammer? Change it now, and anywhere else you used it. See what to do if you already called, let them in, or paid.
Sources
Last reviewed: October 2026.