Guides/Strong password checklist

Strong password checklist (and common mistakes)

A green strength meter helps, but real account safety is a short checklist: long unique secrets, a password manager, and never reusing the same phrase across sites.

Checklist

• Length first — aim for 12+ characters; 16+ for important accounts.
• Unique per site — one breach should not unlock email, bank, and work.
• Manager-generated — random strings beat memorable patterns.
• 2FA where available — especially email and banking.
• Local strength check only — never paste live passwords into unknown remote checkers. See safe strength checks.

Common password mistakes

1. Reuse: Summer2024! on five sites looks “complex” but fails if one site leaks.
2. Short + specials: P@ssw0rd meets rules yet is tiny and well-known.
3. Personal facts: pet names, birth years, or sports teams are easy to guess from social profiles.
4. Keyboard walks: qwerty123, asdfgh — high on breach lists.
5. Writing it in chat or email: treat passwords like keys; do not paste them into tickets or Slack.
6. Trusting the meter alone: strength ≠ phishing protection or “never reuse.”

Worked examples

• Weak: john1985 — short, personal, predictable.
• Better length, still patterned: CorrectHorseBattery — OK as a unique passphrase if not reused; add randomness for high-value accounts.
• Stronger: a 20-character random string from a manager — hard to remember by design; that is the point.

Check a draft locally

Use the freePassword Strength Meterin your browser (no upload). Prefer testing a new draft, not your current inbox password. Building one from scratch?Memorable strong passwords.