UtilForge, free cybersecurity tools for a safer online world. A 2026 Champion of Cybersecurity Awareness Month. Free checks to use before you pay, share or send, and what you check stays on your phone or computer.

Guide · updated 5 October 2026

Passwords that are hard to guess.

Three rules carry most of the advice: at least 16 characters, a different password for every account, and a random mix instead of words a person could guess. A password manager makes that practical, because it creates and stores the passwords so that nothing has to be remembered.

The short answer. Make each password at least 16 characters, different for every account, and random, as the National Cybersecurity Alliance advises. A password manager creates and stores them, so only one master password has to be remembered. A password needs changing when there is a reason, such as a breach notice or suspected access, and regular changes are not needed otherwise.

Last reviewed 5 October 2026. Based on two articles from the National Cybersecurity Alliance, which leads Cybersecurity Awareness Month with the United States Cybersecurity and Infrastructure Security Agency, and on the United States National Institute of Standards and Technology publication SP 800-63B, revision 4. This is general information, not technical advice. UtilForge is a 2026 Champion of Cybersecurity Awareness Month.

The three rules

The National Cybersecurity Alliance article of 25 February 2026 says that three rules matter more than the rest: length, uniqueness and randomness.

  1. Length. At least 16 characters. The National Cybersecurity Alliance says that short passwords, even complicated-looking ones, can be guessed quickly by automated tools, and that the gap between a short password and a 16-character one is a difference of hours or days against millions of years.
  2. A different password for every account. If one account is breached, criminals try the same password everywhere else, and the National Cybersecurity Alliance notes that software and artificial intelligence can help them do this. Adding a number or symbol to an old password does not make it different enough.
  3. Random. A random string of letters, numbers and symbols, with no recognisable word, name, keyboard pattern or date. The National Cybersecurity Alliance says that complexity matters less than length and randomness, and that a long random password is far stronger than a short clever one with swaps such as P@ssw0rd!. Some sites accept spaces, which can make a password longer.

What a password manager does

A password manager is an app, a browser extension or a feature of a device that keeps passwords in an encrypted store. The National Cybersecurity Alliance article of 18 May 2026 says it can create strong passwords, store them, fill in logins, work across devices and, in many cases, warn about breaches and suspicious websites. Only one password, the master password, has to be remembered.

The National Cybersecurity Alliance suggests looking for a manager with a “zero-knowledge” design, which means the company cannot see the passwords and the master password is never stored on its servers. The same article advises turning on multifactor authentication for the manager itself, and says that many good managers have free versions.

UtilForge does not recommend a product and has no link with any password manager. The National Cybersecurity Alliance points to comparison guides from Consumer Reports, PC Magazine, CNET, Tom’s Guide and the Global Cyber Alliance for choosing one.

How to start

The National Cybersecurity Alliance says there is no need to fix everything at once. Its steps, in its words and order, are to choose a reputable password manager, create a strong master password, turn on multifactor authentication, and save passwords as you log in or import them. It advises updating the most important accounts first, such as email, banking and work services, and then replacing weak or reused passwords a few at a time.

The master password matters because most managers cannot recover it. The National Cybersecurity Alliance says to memorise it or keep it somewhere secure, such as a safe.

A notebook is another option. The National Cybersecurity Alliance says that anyone who prefers a physical notebook should still follow the three rules and treat the notebook like cash.

When to change a password

Both sources agree that regular changes are not needed for a password that is long, different and random. The National Cybersecurity Alliance says to change a password if access may have been gained by someone else or if a notice says the account was part of a data breach. National Institute of Standards and Technology’s publication, in section 3.1.1.2, says that services should not require people to change passwords periodically, and that they should force a change if there is evidence of compromise. That rule is written for the websites and services that check passwords. The National Cybersecurity Alliance applies the same thinking to people.

When a site has its own rules

National Institute of Standards and Technology says services should not impose character-mix rules, should accept passwords of at least 64 characters and should accept spaces. Some sites still require a mix of character types or a shorter limit. This paragraph is UtilForge’s own reasoning: where a site will not accept a long password, use the longest it accepts.

Passkeys

The National Cybersecurity Alliance describes passkeys as a newer way to sign in that can replace a password on some sites. A passkey uses a trusted device and a fingerprint or face scan instead of a typed password, and the National Cybersecurity Alliance calls it phishing-resistant, which means it is harder to trick a person into handing it over. Passwords are still needed for many accounts, and many password managers can store passkeys.

Never test a real password on a website

This is UtilForge’s own advice. A real password typed into a website that offers to test its strength has been shared with that website. UtilForge’s Password Habits Check asks six yes or no questions and never asks for a password.

What these rules cannot do

This section is UtilForge’s own reasoning. A long, different, random password protects an account against guessing. It does not protect a password that a person types into a fake page, or reads out to a caller. One rule for any request for money and how to report a suspicious text or call cover those situations.

Sources

Watch: the short video

A short video on password habits that protect your accounts. Watch on YouTube

Related guides

Free

Look again at your
password habits.

Password Habits Check asks six yes or no questions. You type no password, and nothing leaves your phone or computer.

Open the free check All fifteen family checks · pay what you want