How to make a strong password

Passwords are your first line of defence for your online accounts and devices. If you have a weak password, you’re more vulnerable to hacking or other cyberattacks. The easiest way to protect your account and devices is by having a strong password. 

How to create a strong password 

People tend to use easy-to-remember passwords, but the problem with this is that it could translate to easy-to-hack from a cybercriminal's perspective. To secure your accounts better, here are a few pointers to keep in mind: 

Avoid obvious patterns 

This means not using sequential or repeating numbers and letters (e.g., 123, abc, qwerty, 000). These obvious patterns make it easy for hackers to get into people’s accounts. Cybercriminals often use brute force software that can quickly crack passwords that contain sequential numbers and letters. 

Don’t use personal information 

It’s best to avoid using your birthday, name, address, employer and the like as your password. Personal information can be obtained quite easily. One glance at your social media or a Google search of your name can reveal a lot more than you think.

Keep it long and complex 

The longer and more complex your password is, the better it will stand against possible hacks. It’s best practice for a password to have the following attributes: 

• At least 12 characters or longer 
• Have uppercase letters 
• Have lowercase letters 
• Include at least one number 
• Include at least one symbol 

Recently, some websites even require users to incorporate everything listed above to ensure they’re making a strong password. 

Use passphrases instead 

Instead of a singular word, use a string of unrelated words. Using three to five words pads the character count, making it harder to guess. Avoid using popular phrases or names of personalities or characters from television, films, or songs, as these are too common. It’s also a good idea to substitute certain letters with numbers or symbols. 

Keep it memorable 

A string of random letters, numbers, and symbols would make for a really strong password, but it will be useless if you can’t remember it. Opt for words or phrases that you use often that are unrelated to you or the website you’re using them for. You could use a line from a poem or a quote that’s meaningful to you and add a few symbols and numbers to strengthen it. 

Examples of weak passwords 

To help you see the difference between a weak and strong password, here are a few examples of passwords not to use for your accounts: 

• password, password 123, p@sw0rd (or any other iteration of password) 
• qwerty, asdfgh, abcde, edcba (or any combination of sequential letters, even in reverse order) 
• 1234, 5678, 54321, 1111, 0000 (or any iteration of sequential numbers, even in reverse order) 
• abc123, def456, 123abc (or any combination of sequential numbers and letters) 
• Facebook123, Loans.com.auPassword (or any password that contains the name of the website you’re using) 
• JohnDoe1988, PatrickSmith0620, BroncosFan44! (or any password that has your name, birthday, interests or any personal information) 

To check the strength of your password, you can use online password testers like the one from the NSW government. Online password strength checkers are a guarantee that your password is unhackable, but they’re a good gauge of whether it’s strong enough to withstand standard hacking attempts. 

Tips to keep your passwords secure 

A strong password doesn’t make your account immune to cyberattacks. Unfortunately, there’s a host of ways your account can be compromised. But there are additional safety measures you can enact to keep your accounts safer: 

Don’t use the same password for different accounts 

It’s best to use unique passwords for each account and device. Using the same one across all your accounts poses a huge security risk. If one account gets compromised, all your accounts are in danger of getting hacked as well, especially if you use the same email address too. 

Use password managers 

Strong, unique passwords are hard to remember—this is where password managers come in. A password manager is an application that stores all your login credentials in an encrypted vault. This lets you keep strong passwords while making it easier for you to log in to your account. 

For more advice on how to keep your accounts safe, check out the ACSC’s article on creating strong passphrases. You can also look to our security hub for more articles about cybersecurity and tips on how to protect yourself online.