How to Create a Strong Password

Why this matters

Weak and reused passwords are behind a large share of account takeovers. When one website is breached, criminals try the same email and password on banking, email and Microsoft 365. A long, unique password for every important account stops this from spreading.

Step-by-step instructions

1. 1

   Step 1

   Use a passphrase instead of a short password

   Length matters more than complexity. Combine four or more random, unrelated words into a phrase. The Australian Cyber Security Centre recommends passphrases of at least 14 characters.

   • Good example style: "purple kettle harbour violin"
   • Avoid song lyrics, quotes or personal details
2. 2

   Step 2

   Make it unique to each account

   Never reuse a password for your email, banking or work accounts. Your email password is the most important, because it can be used to reset everything else.

3. 3

   Step 3

   Avoid predictable patterns

   Attackers try common substitutions and patterns first.

   • Names, birthdays, pets, sporting teams or suburbs
   • "Password1!", "Summer2026" or keyboard runs like "qwerty"
   • Adding a number to the end of an old password
4. 4

   Step 4

   Store it in a password manager

   A password manager (such as Bitwarden, 1Password or the one built into your browser) can generate and remember a unique password for every site. You only need to remember one strong passphrase to unlock it.

5. 5

   Step 5

   Turn on multi-factor authentication

   Even a strong password can be stolen by phishing. Multi-factor authentication (MFA) adds a second check, such as an app approval, so a stolen password alone is not enough.

Frequently asked questions