Password advice has a reputation problem: most of it seems designed to be impossible. Random symbols, a different password for everything, change them constantly — no wonder so many people give up and use the same familiar word everywhere. Here’s the honest truth: strong passwords don’t have to be hard to remember. They have to be hard to guess. Those are very different things.

Think passphrase, not password

The single best upgrade you can make is switching from a short, complicated password to a long, simple one. Length beats complexity. A phrase like BlueTeapot-Dances-AtNoon is far stronger than P@ssw0rd1 — and far easier to remember, because it paints a picture.

A good passphrase recipe:

• Pick three or four unrelated words — the odder the mental image, the better you’ll remember it.
• Add a capital letter and a number or dash somewhere natural.
• Aim for at least 14 characters. Length is what makes it strong.
• Avoid the guessable: names of children or pets, birthdays, anniversaries, or your address — these are the first things anyone tries, and much of it is public.

The one rule that matters most: don’t reuse

When a company has a data leak (and they happen constantly), criminals take the leaked email-and-password pairs and try them everywhere else — your bank, your email, your pharmacy. This automated trick only works if you reuse passwords. The accounts that truly need their own unique passphrase are:

• Your email — because it can reset every other account you own.
• Your bank and investment accounts.
• Medical and insurance portals.

Get those four or five unique, and you’ve eliminated the biggest risk in one afternoon.

It’s okay to write them down (the right way)

You may have heard “never write passwords down.” For most people, a paper notebook kept somewhere private at home is a perfectly reasonable system — burglars aren’t hunting notebooks, and paper can’t be hacked. What to avoid is a sticky note on the monitor, a note taped inside an unlocked drawer at a shared computer desk, or a “passwords” file on the computer desktop.

Or let a password manager remember everything

A password manager is a small program that stores all your passwords inside one locked vault, fills them in for you, and can invent strong new ones on demand. You remember exactly one master passphrase; it remembers the rest. Reputable options are inexpensive or free, and browsers like Chrome, Safari, and Edge include basic built-in versions. If you’re comfortable trying one, it’s the closest thing security has to a magic wand — and it’s a topic we walk through slowly, hands-on, in our device and password safety workshop.

Turn on two-factor authentication for the big accounts

Two-factor authentication (often shortened to 2FA) means that signing in takes your password plus a one-time code — usually texted to your phone. Even if someone steals your password, they can’t get in without your phone. It adds about ten seconds to logging in and is worth every one of them on your email and bank accounts. If a grandchild helps set it up, the whole job takes an afternoon visit.

What about the password on the fridge list nobody mentions?

One more: the voicemail PIN and the phone’s lock code. A phone that unlocks with 1-2-3-4 hands a stranger your email, photos, and saved passwords in one swipe. Choose a code that isn’t your birth year, and you’ve closed a door most people forget exists.

Frequently asked questions

How often should I change my passwords?

Modern guidance is refreshingly kind: you don’t need to change a strong, unique passphrase on a schedule. Change a password when there’s a reason — a breach notice, a scam scare, or a shared account that shouldn’t be shared anymore.

Are the passwords my browser saves safe to use?

For most people, yes — a browser’s built-in password manager is far safer than reusing one password everywhere. Just make sure the computer itself has its own login and isn’t shared with strangers.

What’s the safest way to share a password with family I trust?

In person or by phone call — never by email or text, which can be read later if an account is compromised. Better yet, many password managers have a built-in family-sharing feature designed for exactly this.