Most accounts are not broken into by someone cleverly guessing a password. They are opened with a password that leaked from a different website, because the same one was used in both places. Fixing that matters more than any rule about symbols.
The three rules that matter
- A different password for every important account. Email, Facebook, bank and anything with your money should each have their own. If one leaks, the others stay safe.
- Long rather than complicated. Four or five random words, like
mango kettle silver lagoon, are far harder to crack thanP@ssw0rd1, and easier to remember. - Your email password is the master key. Anyone in your email can reset every other password. Make it the strongest one and turn on two-step verification there first.
What makes a password weak
- Your name, a child's name, a date of birth, a phone number, a football club.
123456,password,qwerty, or any of these with a number added.- The same password with one number changed each time.
- Anything you have ever shared with anyone.
Let a password manager remember them
Nobody can remember twenty strong, different passwords. A password manager stores them, fills them in for you, and creates new ones. You only remember one strong password to open it.
- Google Password Manager is built into Chrome and Android, free, and already syncing if you are signed in to Chrome. Check it at passwords.google.com.
- iCloud Keychain on iPhones and Macs, free.
- Bitwarden is free, works on every phone and computer, and is a good choice if you use a mix of devices.
When Chrome or your phone offers to "use a strong password", accept it. It saves it for you.
Check whether yours have leaked
Google Password Manager has a Password Checkup that tells you which saved passwords appeared in known leaks, which are reused, and which are weak. Change the ones it flags, starting with email and anything financial.
PINs
The same logic applies to your phone, MoMo and bank card PINs: avoid birth years, 1234, 0000 and repeated digits, and do not use the same PIN for your screen lock and your mobile money, because people see you unlock your phone all day.
Where to write them down, if you must
On paper, kept at home, not on the phone and not in a note called "passwords". Paper at home is safer than a reused password.