How to create a secure password

People lose money to account takeovers every year—but you don’t have to. Instead of using simple passwords and reusing them across your accounts, create long and unique passwords to keep your accounts more secure. And get Norton 360 Deluxe with its built-in password manager to help keep your passwords safe and protect against hacking.

June 2025 update: 16 billion login credentials have been leaked, affecting Apple, Google, and Facebook users.

What happened: A compilation of over 16 billion login credentials, including passwords, has been exposed in one of the largest data leaks in history. Criminals have found and repackaged this information, which is now for sale on the dark web. If exploited, it could be used to compromise your accounts or commit identity theft.
What you should do: Use long and unique passwords or passphrases for all your accounts. If you think your credentials may be at risk, update your passwords immediately.

You might be tempted to make your passwords easier to remember or incorporate cues from your daily life, like birth dates, anniversaries, and pet names. Unfortunately, these tidbits of information make your passwords more predictable and leave them more susceptible to brute force attacks, credential stuffing, and dictionary attacks.

To better protect yourself from cybercrime and account takeovers, create secure passwords by leveraging randomization, length, originality, and passphrases.

5 tips to create secure passwords

When it comes to online security, creating long, strong, and unique passwords is your first line of defense. Here are five key tips to create strong passwords, fortify your accounts, and keep your personal information safer online:

Password mistakes to avoid

Make your passwords more secure by avoiding the following:

Numerical patterns like “1234”
Common words like “password” or “guest”
Repeated characters like “1111”
Keyboard patterns like “qazwsx” or “asdf”
First and last names
Pet and family member names
Nicknames
Important dates
Cities you’ve lived in
Schools you’ve attended
Reversed words like “drowssap”
Character substitutions like using “@” in place of “a”

1. Randomize your passwords

Random passwords are the ultimate shield against hackers. Since they lack patterns and personal information, it’s nearly impossible for hackers to guess them using dictionary attacks, numerical patterns like “123,” or birthday predictions. You should also avoid falling into the trap of using guessable words that are significant to your life, like nicknames, surnames, pets, cities, and schools you attended.

2. Make passwords long

Longer passwords are more secure because every additional character increases the number of possible combinations. That means that it’s harder for hackers to guess your password. It also makes the password-cracking process more time-intensive, which could deter brute force attacks. To maximize account security, make your passwords at least 15 characters long.

3. Avoid password recycling

Recycling the same password across accounts makes your passwords less secure. If an attacker compromises one password, all your accounts with the same password are at risk. To boost your password security, create a strong and unique password for every account. You can use a secure password generator to create them and a password manager to store them.

4. Use symbols, cases, and spellings

Even if you develop a completely original password, it could still be easy to guess if you spell a word correctly, use predictable cases, and don’t use numbers or symbols. Up the ante by incorporating a mix of uppercase (A – Z) and lowercase letters (a – z), numbers (0 – 9), and symbols (#, $, %). Also, don’t substitute letters with symbols or numbers (like “p@ssw0rd”) unless you’re creating a passphrase—most cybercriminals are well aware of this password trick.

5. Opt for long passphrases

Passphrases are strings of words that can help protect your accounts in the event of password attacks. They should use a complex and lengthy mix of characters, 5 to 7 words, and symbols. As a bonus, they are easier to remember since you can base them on movie quotes, rhymes, songs, etc., making them especially useful for securing your home computer lock screen.

Just don’t use personal information or choose a passphrase directly linked to something you’ve shared publicly. For example, if you’re a loud and proud Swiftie, don’t use one of Taylor Swift’s songs to inspire your passphrase.

If you’re not sure whether your passphrases are strong enough, consider using a random password generator to come up with hard-to-crack ideas.

How to remember strong passwords

While strong passwords are vital, remembering them can be tough, especially when you’re supposed to have a long, strong, and unique iteration for each account. Consider using a password manager like Norton Password Manager or mnemonics to stay on top of your passwords.

Password managers

A password manager is a secure digital vault that stores all your passwords. You just need to remember one master password to access it. Then, you can securely and conveniently auto-fill your credentials when you visit a website’s login page.

Mnemonic devices

A mnemonic device is a memory trick that helps you recall information by associating it with something more memorable, such as a phrase or rhyme. You can use these to remember secure and complex passwords—just come up with a memorable phrase or acronym.

For example, you know you shouldn’t use your name in a password. But you can use your name as a mnemonic device for a passphrase. So, instead of making your password “AdamC” (your first name and surname initial), you could use the mnemonic device, “AstronautDrivesArmorMiracleCorduroy,” to remember each word of your passphrase. Of course, you also need to mix up the cases and add numbers and symbols.

Why is password security important?

If passwords aren’t strong and kept secure, cybercriminals could gain access to your accounts. That can lead to scams, financial repercussions, or even identity theft. And then there’s the added stress of recovering hacked accounts or a stolen identity.

Scams: If a cybercriminal can access your social media accounts or email with your password, they could scam your contacts or use your own information against you in a social engineering attack.
Financial loss: Whether it’s your bank account drained, blackmail, or transferring money from your payment app, the end goal for password thieves is typically financial.
Identity theft: If an identity thief has enough information about you, a password could be the final piece of the puzzle they need to achieve their objective. That could be anything from taking out a loan in your name to ordering a new credit card and intercepting it.

Scan the dark web for your passwords

Once they steal your passwords, hackers and phishers may sell them on the dark web – potentially exposing your personal data to a nefarious cohort of scammers, cyber thieves, and other unsavory characters. This puts you at a higher risk of identity theft.

For an added layer of protection, install Norton 360 Deluxe. Its advanced Dark Web Monitoring feature scans the murkiest corners of the internet and alerts you if your personal data is found, so you can take steps to protect yourself.

How are passwords stolen?

Cybercriminals steal passwords through a variety of methods using scams or hacking techniques.

Data breaches: If your password is exposed in a data breach, hackers can use it to access the associated account.
Password-guessing attacks: Dictionary attacks involve hackers trying common words and phrases at scale to guess passwords.
Malware: Some types of malware can steal your passwords or record your keystrokes as you type.
Phishing: A phishing attack can be designed to trick you into revealing your password. An attack via email or text could also urge you to click a link that takes you to an unsafe website where you enter your password and unknowingly expose it.
Social engineering: Phishing is a common type of social engineering attack but there are other examples, like a scareware attack that could lead to a hacker stealing your password.

How to keep your passwords safe

Password security requires a comprehensive approach. To keep your passwords safe:

Create long, complex passwords
Use unique passwords for every account
Use a reputable password manager
Enable two-factor authentication (2FA)
Use passkeys instead of passwords. Passkeys are a secure method of signing into your accounts that rely on biometrics or your device’s PIN instead of traditional passwords.
Change your passwords regularly
Subscribe to data breach alerts
Avoid clicking suspicious links
Don’t share your passwords with anyone
Use a reputable security app like Norton 360 Deluxe

Help keep hackers out of your accounts

Strong passwords alone aren’t a foolproof defense against all cyberattacks. However, a strong password coupled with a security tool like Norton 360 Deluxe can go a long way toward safeguarding your accounts and devices.

Norton 360 Deluxe includes a built-in Password Manager to help you create, store, and secure your passwords. Plus, it offers powerful protection against hackers, malware, and other online threats.