The simplest reliable formula is length plus uniqueness. For a password you must remember, use a passphrase made from several unrelated words. For every other account, let a password manager create and store a different random password. Add multifactor authentication (MFA), or a passkey where available, because even an excellent password can be stolen through phishing, malware or social engineering.
NIST’s current guidance (SP 800-63B-4, July 2025) says a password used as a single authentication factor should be at least 15 characters. It also says services should not force arbitrary mixtures of uppercase letters, numbers and symbols, and should allow passwords of at least 64 characters, including spaces. Those are verifier requirements, not a guarantee that every website has implemented them.
As an Amazon Associate I earn from qualifying purchases.
What makes a password strong and usable?
Password strength has two separate dimensions: resistance to guessing and resistance to reuse-related damage. A long, unpredictable password is difficult to guess. A unique password limits the damage if one company’s database is breached. Memorability matters because a password that you cannot use correctly often leads to unsafe workarounds, such as writing it beside the computer or reusing an easier password.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe goal is therefore not to invent one clever password for your entire digital life. It is to use one memorable credential where necessary, unique generated credentials everywhere else, and an additional factor for important accounts.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Long: More characters generally increase the work required to guess a password.
- Unique: No password should protect two different services.
- Unpredictable: Avoid information an attacker can learn about you or patterns used in common passwords.
- Manageable: Use a passphrase for passwords you type from memory and a password manager for the rest.
- Layered: Use MFA or a passkey when the service supports it.
Why length beats forced character gymnastics
Many websites still display rules such as “one uppercase letter, one number and one symbol.” NIST SP 800-63B-4 says verifiers should not impose composition rules of that kind. Forced substitutions often produce predictable patterns, such as changing a final letter to a number, without making the password meaningfully memorable.
For a password that is the only authentication factor, NIST sets a minimum of 15 characters. When a password is used only as one part of MFA, a service may allow a shorter minimum. The service ultimately controls what it accepts, so use the longest suitable password it permits rather than assuming every site follows the NIST minimum.
| Guidance | What it means for you |
|---|---|
| At least 15 characters for a single-factor password | Use this as a baseline when the service allows it. |
| Maximum length of at least 64 characters | A well-designed service should not reject a long passphrase or generated password merely because it is lengthy. |
| Spaces should be accepted | Spaces can make a passphrase easier to read and remember. |
| No mandatory character-type mix | Do not shorten a password just to satisfy arbitrary uppercase, number or symbol rules; follow the site’s actual requirements. |
| Shorter minimums may apply when the password is only part of MFA | Do not interpret a shorter field limit as a universal security recommendation. |
If a service rejects spaces or long values, choose the longest distinctive password it accepts and rely on uniqueness and MFA to compensate for that limitation. Never weaken a password by reusing it elsewhere.
Recommended Free Tools
How to make a memorable passphrase
A passphrase is a password built from multiple words. Its advantage is that adding words increases length without requiring you to memorize an arbitrary string. NIST describes multiword passphrases as an effective way to create longer passwords.
1. Decide whether you actually need to memorize it
Your primary password-manager unlock password, a device login, or a recovery credential may need to be typed from memory. For an online account that your manager can fill automatically, use a generated password instead. Do not spend effort memorizing dozens of credentials when software can store them safely.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
2. Choose several unrelated words
Select words that are not connected to your name, address, employer, family, pets, hobbies or other information visible on social media. Avoid a familiar quotation, song lyric, proverb or book title; attackers test popular text and predictable word sequences. Do not copy a phrase shown in an article, password-strength meter or example list. Make your own selection privately.
3. Make the result long enough
Use enough words to meet the service’s requirements and, when it is a single factor, aim for at least 15 characters. More words are appropriate when the service allows them. Spaces are useful if accepted, but they are not mandatory; a passphrase can use another separator required by the service.
Free tools Windows power users keep installed
One-click scans. No signup required.
4. Avoid personal “cleverness”
Replacing “a” with “@” or adding “1!” to the end does not turn a familiar phrase into a strong one. If a site requires a symbol or number, add them in a way you can remember, but do not rely on those changes to provide most of the security. Length, uncommon word combinations and uniqueness do the important work.
5. Enter it carefully and store a recovery path
Check whether the service treats spaces, capitalization and trailing characters exactly as entered. Record the account’s recovery options in your password manager’s secure notes or another protected location. Never store the passphrase in an unencrypted note, email draft or browser bookmark.
Use a password manager for every password you do not need to remember
A manager can generate a long, random password for each account and fill it when you sign in. CISA advises configuring generated passwords for length, randomness and uniqueness. A generated value may be impossible to memorize; that is a feature, not a defect, when the manager is handling it.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Set up a manager safely
- Create one strong vault password. Use a long passphrase that is unique to the manager. It is the credential you must be able to reproduce without the vault.
- Turn on MFA for the manager account. NIST specifically advises choosing a manager that supports MFA for the login protecting its vault.
- Install only the official applications and browser extension. Verify the publisher and keep the software updated.
- Import or add accounts carefully. Remove duplicate or obsolete entries so you can see which credentials are current.
- Replace reused passwords first. Start with email, financial, work, medical and cloud accounts, then change lower-risk accounts in batches.
- Generate a new value for each service. Use the site’s longest practical length and required characters, then save the result in the matching entry.
- Test sign-in and recovery. Sign out, use autofill, and confirm that you can retrieve the account if the manager is unavailable.
Compare managers by security and recovery, not by a feature checklist
No single storage model is best for everyone. CISA describes a trade-off between cloud convenience and locally maintained storage. Cloud storage can synchronize across devices and simplify recovery, but it makes the account and provider availability part of your plan. Local storage gives you more direct control, yet you must maintain backups and ensure they remain accessible when a device fails.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Question to ask | Why it matters |
|---|---|
| Which phones, computers and browsers are supported? | A vault you cannot access on a needed device encourages unsafe password reuse. |
| How does vault recovery work? | Understand emergency access, recovery codes and what happens if the primary device is lost. |
| Does the vault login support MFA? | The manager protects every stored credential, so its own login needs an additional defense. |
| How does autofill behave? | It should be predictable on your sites and easy to disable when you do not want a credential inserted. |
| Is storage cloud-based, local or both? | Cloud synchronization reduces maintenance; local storage requires you to handle backups and device migration. |
| Do you need sharing or separate vaults? | Families and teams should be able to share selected credentials without exposing the entire vault. |
Protect backups and recovery codes
A password manager is not a substitute for a recovery plan. Keep recovery codes for MFA in a protected place separate from the device that normally generates or receives them. If you maintain a local vault, make encrypted backups and test restoring one before you need it. If the manager offers an emergency-contact or recovery feature, understand exactly what that person can access and how approval works.
Make each account password unique
Reusing a password creates a chain reaction. If one service is breached, attackers can try the exposed email-and-password pair on email, shopping, banking, workplace and social accounts. A strong password reused ten times is still one compromised secret.
Change passwords in this order when you are converting an old setup:
- Your primary email account, because it can reset other accounts.
- Financial, tax, health and government services.
- Work, school, cloud storage and collaboration accounts.
- Your phone, computer and password-manager accounts.
- Social, shopping, entertainment and other accounts.
After each change, sign out other sessions if the service offers that option. Do not keep a second “backup” password that you use on several sites. If an account cannot be changed immediately, enable MFA and treat the old value as temporary until it is replaced.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Add MFA or a passkey
A password is one factor: something you know. MFA adds another factor, such as a device, security key, authenticator application or biometric unlock. Turn it on for the password manager, email, financial services and any account containing personal or work data.
NIST notes that MFA methods do not all provide the same protection. Follow the service’s strongest practical option and save its recovery codes. A physical security key is an option for services that support the relevant standard; check compatibility with your devices and accounts before buying one.
When a passkey is available
Passkeys use a cryptographic credential stored on an approved device or security key. NIST describes them as not requiring password memorization and as less susceptible to phishing than passwords. Enrollment and recovery differ by service, so keep an approved device or recovery method available. You may still need a password for account recovery or for services that have not adopted passkeys.
Do not treat MFA as permission to reuse passwords
MFA reduces risk but does not make reuse safe. An attacker may target the account with phishing, steal a session, or exploit a service that does not enforce MFA consistently. Keep every password unique even after adding a second factor.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Know what a strong password cannot stop
NIST warns that phishing, keystroke logging and social engineering can defeat long, complex passwords. A phishing page can persuade you to type a valid password and an MFA code. Malware can record keystrokes or capture an unlocked session. A caller or message can manipulate you into revealing a recovery code.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Check the address and context before signing in; do not use a link from an unexpected message.
- Never disclose a password, MFA code or recovery code to someone who contacts you.
- Keep your operating system, browser, phone and security software updated.
- Use a passkey or phishing-resistant MFA method when the service supports it.
- Review sign-in alerts and active sessions for accounts containing sensitive data.
If you suspect phishing or malware, change the affected password from a clean device, revoke active sessions, remove unknown MFA devices, and contact the service through its official support channel. Changing a password alone may not end an attacker’s existing session.
When to change a password
Change a password when there is evidence it was exposed: a breach notification, suspicious sign-in, phishing disclosure, malware infection or accidental sharing. NIST says verifiers should not force periodic password changes when there is no evidence of compromise. Routine forced rotation often produces predictable variations, such as adding a new number to an old password.
Change immediately if the password was used on more than one service, even if you have not seen an alert. Replace the reused value everywhere, starting with email and other accounts that can reset it. Do not wait for a scheduled “password day.”
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A practical setup you can finish in one session
- List your important accounts and mark which ones contain financial, health, work or identity information.
- Choose a password manager that supports your devices, MFA and a recovery method you understand.
- Create a unique, long vault passphrase and enable MFA on the manager.
- Secure your primary email with a unique generated password, MFA or a passkey, and recovery codes.
- Replace reused passwords on high-impact accounts first.
- For each remaining account, generate a unique password, save it, and test autofill before moving on.
- Review account security pages for unknown sessions, recovery addresses and MFA devices.
- Store recovery codes in a protected backup location and test that you can reach it.
After this initial conversion, new accounts should follow the same rule: generate a unique password, save it immediately, and enable MFA or a passkey before adding valuable information.
Common problems and fixes
| Problem | Safer response |
|---|---|
| The site rejects a long passphrase | Use the longest value it accepts, remove unsupported spaces only if necessary, and enable MFA. Do not reuse the shortened password elsewhere. |
| The site demands a symbol or number | Meet the stated requirement while keeping the password long and unique; the requirement does not replace those properties. |
| You forgot the vault password | Use the manager’s documented recovery process or emergency access. Do not create a second vault with a reused password until you understand the consequences. |
| Autofill does not work on one service | Confirm the correct login entry, update the extension or app, and use manual copy-and-paste only on the verified service address. |
| You receive a breach notice | Change that service’s password, replace the same password anywhere else it appeared, revoke sessions and check MFA settings. |
| You cannot decide between cloud and local storage | Choose cloud if dependable synchronization and simpler recovery matter most; choose local only if you will maintain encrypted backups and device migration yourself. |
The bottom line for everyday use
Remember one long, private passphrase for your password manager and let it generate a different random password for every account. Use the longest value each service accepts, aim for at least 15 characters when a password is the sole factor, and do not rely on forced character substitutions. Protect the manager and high-value accounts with MFA, choose a passkey when available, keep recovery codes safe, and change credentials when there is evidence of compromise. This approach is stronger than trying to memorize a complicated password for every site—and easier to maintain over time.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
