How can I create strong passwords I can actually manage?

The two things that make a password strong are its length and being used in only one place. But remembering dozens of long, different passwords is impossible - which is exactly what a password manager is for. It is simpler than it sounds.

What makes a password strong

  • Length beats complexity. A long passphrase of four or five random words is stronger, and easier, than something like "P@ssw0rd1".
  • Different for every account. If one website is broken into, a password you reused means every account with it is suddenly at risk.
  • Nothing to do with you. No names, pets, or birthdays.

You do not need to memorise any of these. That is the manager's job.

What a password manager actually is

Think of it as an encrypted pocket book: a private notebook for your passwords that only you can open, locked with one master password (or your face or fingerprint). It remembers every password for you and types them in when you sign in, so the only one you ever need to remember is that single master password.

Here is the part that trips people up. The manager keeps a copy of each password. The real password lives on the website or app it belongs to - your bank, your email, and so on. The website is the real lock; the manager is just your book of keys.

Because of that:

  • Changing a password inside the manager does not change it on the website. It only edits your copy - and now the copy no longer matches, so you would be locked out until you put it back.
  • To actually change a password, change it on the website or app first, in its own settings. Then save the new one in the manager, which usually offers to do it for you.

Simple rule: change the lock on the website first, then update your book.

Turn it on so it offers your passwords

So the manager fills passwords in for you on sign-in screens, you switch on "autofill" once:

  • iPhone or iPad: open Settings, tap General, then AutoFill & Passwords. Turn on AutoFill Passwords, and make sure Passwords (Apple's built-in manager) - or whichever app you use, like 1Password - is ticked. On older iPhones the path is Settings, then Passwords, then Password Options.
  • Android: open Settings and search for "autofill", then choose your autofill service - Google, or the app you use.

From then on, when a sign-in box appears, your phone offers the saved password and you just tap it.

Getting started

  1. Pick a manager. The one already built into your phone - Apple Passwords, or Google Password Manager - is free and there is nothing to install. Or use an app like 1Password or Bitwarden.
  2. Give it one strong master password you do not use anywhere else. This is the only one you need to remember.
  3. Switch on autofill, as above.
  4. From now on, let it save each password as you sign in, and let it suggest a strong one whenever you create an account.

What about passkeys?

Increasingly, sites and apps also offer a passkey - a newer way to sign in with just your face or fingerprint, and no password to remember or steal. Where one is offered, it is worth saying yes, and your password manager can store passkeys too. See what is a passkey, and should I use one?

If you only do one thing

Start using the manager already on your phone, and let it remember your email password first. And keep the simple rule in mind: to change a password, change it on the website, then update your book.

Related: How can I set up two-factor authentication?

← All guides

General information, correct when last reviewed. Platforms and threats change - always confirm critical steps on the official source. Product names are used only to describe their features; Monkleton Labs is not affiliated with, or endorsed by, them. No ads, no affiliate links.