A strong password is long, hard to guess, and used for only one account. A password manager can create and store a different password for every service, while multi-factor authentication (MFA) adds another layer of protection. You generally do not need to change a sound password just because it is old: change it promptly if there is evidence it was exposed or compromised.
What makes a password strong?
Strength comes mainly from length, uniqueness, and unpredictability—not from making a password look complicated. The Federal Trade Commission (FTC) recommends aiming for at least 12 characters. NIST’s current digital identity standard sets a different minimum for services: at least 15 characters when a password is the sole authentication factor, or at least 8 characters when it is used only as part of MFA. These NIST figures are requirements for covered services, not a universal instruction to replace an existing password or use the same length in every situation. FTC consumer guidance; NIST SP 800-63B-4.
As an Amazon Associate I earn from qualifying purchases.
Those numbers have different purposes. The FTC’s 12-character advice is a consumer recommendation for choosing a password. NIST’s 15-character minimum applies to a service that uses a password as a single-factor authenticator; its 8-character minimum applies when a password is used only as one part of MFA. Neither number is a study statistic, and the NIST requirements are directed at services and covered identity systems. For a personal account, a useful rule is to make the password as long as the site allows, while following any requirements that service actually sets.
Free tools Windows power users keep installed
One-click scans. No signup required.
Make it long and difficult to predict
Longer passwords are generally harder to guess. If you need to remember one, the FTC suggests using a passphrase made from random words rather than a familiar quotation or common phrase. A password that looks unusual is not necessarily unpredictable: changing a familiar word with a predictable digit or symbol does not make it a sound choice.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A passphrase is not automatically strong just because it contains several words. The words should not form a well-known line, common expression, or other phrase someone might reasonably guess. Randomness matters: a long phrase built from an obvious personal detail or familiar sequence can still be predictable. If a password manager generates and stores the credential, you can use a long, distinct password without needing to memorize it; reserve memorization for passwords you genuinely need to enter yourself.
Use a different password for every account
Never reuse a password across services. If one company suffers a breach, attackers may try the exposed login details on other sites. A unique password limits the damage: a password exposed at one service does not also unlock accounts where you chose different credentials. NIST SP 800-63B-4; NIST SP 800-63 FAQ.
The same principle applies to close variations. If you change only one digit or symbol between accounts, someone who learns one version may be able to guess another. Treat a password and its close variations as reused credentials: give every account its own distinct replacement. This is especially important after a breach notice, when exposed credentials may be tried elsewhere.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Prioritize unpredictability over character-mix rules
NIST’s current standard says services must not impose composition rules such as requiring a mix of uppercase and lowercase letters, numbers, and symbols. Instead, it requires services to check new passwords against a blocklist of common, expected, or compromised values. Some websites still set their own character requirements; follow those rules when creating an account, but do not mistake a predictable substitution for real strength. NIST SP 800-63B-4.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
This distinction is useful when a sign-up form asks for a symbol or number. Meet the site’s stated requirements, but do not assume that adding a predictable character to an otherwise common password solves the problem. The broader goal is a long, unique password that is not an obvious choice. A site’s composition rules may vary; NIST’s standard describes what covered services should require, not a guarantee that every website uses the same rules.
How to create and manage strong passwords
Use a password manager
A password manager can generate and retain a long, distinct password for each account, so you do not have to memorize them all. Protect its vault with a strong master passphrase, and enable MFA for the manager if available. NIST and the FTC both recommend password managers as practical tools for selecting and maintaining unique passwords. NIST SP 800-63 FAQ; FTC consumer guidance.
The manager is a way to make uniqueness manageable, not a reason to reuse one memorable password everywhere. The master passphrase protects the vault, so make it strong and do not use it for another account. MFA on the manager adds another check if it is offered. This research does not rank specific password managers; if choosing one, relevant questions include whether it works with your devices, how its vault and recovery work, and whether it supports MFA.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Choose a manager and secure its account. Set a strong master passphrase that you do not use anywhere else. Turn on MFA if the manager offers it.
- Generate a unique password for each account. Use the manager’s generator rather than adapting one familiar password for multiple sites.
- Save the credentials in the vault. Confirm the manager has stored the right username and password before signing out.
- Update reused passwords first. If you have reused a password, replace it on each affected account with a different generated password.
If you are starting from a collection of reused passwords, you do not need to make one new shared password. Work through the accounts and give each one a distinct credential. When a site imposes a length or character rule, follow that site’s requirements rather than weakening the password everywhere else. The manager can help you keep track of which credential belongs to which service.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Turn on multi-factor authentication
MFA asks for another check in addition to your password. It can reduce the risk that a stolen or phished password alone is enough to access your account. Enable MFA wherever it is offered, especially for important accounts. NIST’s consumer guidance includes security keys among possible MFA methods; a key is an optional additional protection, not a substitute for unique passwords. NIST consumer password guidance; NIST SP 800-63B-4.
Use the MFA options the service makes available. NIST consumer guidance identifies security keys, including USB dongles, as one possible method; it does not make a key a replacement for a strong, unique password. If you are considering an additional device, treat it as an optional account-protection tool and check that the service supports it. The research here does not rank MFA methods or specific products, so there is no universal product recommendation to make.
Should you change passwords regularly?
For ordinary personal accounts, do not change a good password on an arbitrary schedule just because it has been in use for a while. NIST SP 800-63B-4 says covered services must not require periodic password changes; it also says they must force a change when there is evidence the authenticator was compromised. That is guidance for verifiers and covered digital identity systems, and it is not a claim that every service or workplace follows identical policies. NIST SP 800-63B-4.
Recommended Free Tools
NIST states in section 3.1.1: “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.” The section continues: “However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised.” The wording is part of the July 2025 standard and applies to its verifier and covered-system context. It does not mean that every personal account provider follows the same policy, nor that an organization cannot have its own rules.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Routine rotation can prompt people to make small, predictable variations rather than genuinely new passwords. For personal accounts, use evidence of exposure or compromise—not a recurring calendar date—as the practical reason to change a sound password. If a workplace or service sets a policy, it may differ from the general consumer guidance; distinguish that local rule from NIST’s recommendation for covered verifiers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When should you change a password?
A service reports a breach
If a company tells you it lost your password in a data breach, change that password immediately. If you used it, or a close variation, on other services, change those passwords too. Give each account a distinct replacement rather than changing one shared password once and reusing the new version. FTC consumer guidance.
Start with the affected service, then review other accounts where the same password or a close variation was used. Replace each one with its own new password. Do not wait for a routine password-change date: the breach notice is evidence that the old credential may be exposed. If the service offers MFA, turn it on as an additional safeguard; MFA does not remove the need to replace a compromised or reused password.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsYou have other evidence of compromise
Change the affected password when you have evidence it was compromised, such as a service alert or an account incident that indicates someone else may have accessed it. If that password was reused or closely varied elsewhere, change those accounts as well. NIST’s standard requires covered services to force a password change when there is evidence of compromise; the FTC advises consumers to act immediately when a company reports that their password was lost in a breach. NIST SP 800-63B-4; FTC consumer guidance.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
The trigger is evidence, not simply age. If there is no indication that a sound, unique password has been exposed, the guidance does not call for changing it on a calendar schedule. If there is evidence of exposure, act promptly, change the affected credential, and replace any reused or closely related passwords with unique ones.
A practical password checklist
- Use a long password; the FTC’s consumer target is at least 12 characters.
- For services using a password alone, NIST’s current minimum requirement is 15 characters; when a password is only part of MFA, the service requirement is at least 8. These are verifier requirements, not a universal instruction for every consumer account.
- Choose a different password for every account, avoiding close variations.
- Use a password manager to generate and store credentials you do not need to memorize; protect the vault with a strong master passphrase and MFA if available.
- Enable MFA wherever it is available. A security key is one possible option, not a replacement for unique passwords.
- Change passwords promptly after evidence of exposure or compromise, including reused or closely related passwords.
- Do not rotate a sound personal-account password solely because a set amount of time has passed.
Frequently Asked Questions
How long should a strong password be?
The FTC recommends aiming for at least 12 characters. NIST SP 800-63B-4 sets a 15-character minimum for services using a password as a single factor, and an 8-character minimum when the password is only part of MFA. The NIST numbers are requirements for covered services, not a universal instruction to change every existing password.
How often should I change my passwords?
For a sound personal-account password, do not change it solely because it is old or a date has passed. Change it promptly when there is evidence it was exposed or compromised. Some workplaces and services may have their own policies.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Should I change passwords after a data breach?
Yes. If a company reports that it lost your password, change it immediately. Also change passwords on any other accounts where you used the same password or a close variation, giving each account a distinct replacement.
Do I need uppercase letters, numbers, and symbols for a strong password?
Not necessarily. NIST’s current standard says covered services should not impose character-mix rules; it emphasizes length and checks against common, expected, or compromised passwords. Follow a site’s own requirements, but do not assume a predictable substitution makes a password strong.
Can a password manager make passwords unique?
A password manager can generate and retain a distinct password for each account, so you do not have to memorize them all. Use a strong master passphrase for its vault and enable MFA for the manager if available.
The Bottom Line
Make passwords long, unpredictable, and unique to each account; a password manager helps, and MFA adds protection. You generally do not need to change a sound password on a schedule. Change it promptly after evidence of compromise, including any reused or closely related passwords.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
