One long password per account, kept in a manager
Reused passwords are how one leaked website turns into five lost accounts. A password manager removes the reason to reuse.
Why reuse is the real problem
Websites are breached every week, and the stolen lists of emails and passwords are traded and tried on other services automatically. If the password for a forgotten forum also opens your work mail, the attacker does not need to guess anything.
A unique password limits a breach to the one site where it happened.
What a strong password looks like
Length does more than complexity. Sixteen characters or more, generated at random, is a good default. For the few passwords you must type from memory, use a passphrase: four or five unrelated words are long, hard to guess and easy to type.
Rules that force a change every few months tend to produce weaker passwords. Change a password when you have a reason: a breach notice, a shared secret, or a device you no longer control.
Let a manager remember them
A password manager creates a different random password for every account and fills it in for you. You remember one strong passphrase for the manager itself and protect it with a second sign-in step.
A manager also helps against phishing. It fills a password only on the site it was saved for, so on a look-alike page it stays silent.
This note is our own plain-language summary. For the full guidance, read the original: https://www.cisa.gov/secure-our-world/use-strong-passwords
Next noteTurn on a second step for sign-in
If the manager will not fill the password, check the address bar.