Passwords Made Simple: How to Create Strong Ones and Use a Password Manager

Confession time. For years, my “strong” password was my nickname, my birth year and an exclamation mark. I used it on Gmail, Facebook, two shopping sites and a random forum I joined in 2012. When that forum got hacked, I spent a very stressful weekend changing everything.

If any part of that sounds familiar, don’t feel bad – most people do some version of this. The fix is simpler than you think, and you don’t need to memorise 50 complicated passwords. Let me show you how.

Why Weak Passwords Get Broken

Hackers don’t usually sit there guessing your password one by one. They use automated tools that try:

• Common passwords – things like 123456, password, qwerty, iloveyou, and so on.
• Personal info – your name, birth year, phone number, pet’s name, cricket team.
• Leaked passwords – this is the big one. When one website is hacked, the email-password combinations often end up online. Attackers then try those same combinations on Gmail, Instagram, Amazon and banking sites. This is called credential stuffing.

That last point is why reusing passwords is the most dangerous habit. One weak website can expose all your accounts.

What Makes a Password Strong?

Three things, in order of importance:

1. Unique – used on only one account.
2. Long – length matters more than fancy symbols. Longer passwords take vastly longer to crack.
3. Unpredictable – not based on personal info or common patterns.

The Easiest Way: Passphrases

A passphrase is a few random words strung together. It’s long, hard to guess, and surprisingly easy to remember.

For example (please don’t use these exact ones):

• mango-bicycle-rain-pillow-87
• Purple Auto Dances At Midnight!
• chai-tiger-notebook-cloud

Compare that to Rahul@1998. The passphrase is much longer and doesn’t contain anything about you.

Tips for good passphrases:

• Use 4 or more random words. Truly random – not a famous quote or song lyric.
• Add a number or symbol if the site requires it.
• Don’t use words connected to you (your city, your kid’s name, your bike model).

Passphrases are perfect for the few passwords you need to actually remember – like your phone lock, your email, and your password manager’s master password.

You Don’t Need to Remember Everything: Use a Password Manager

A password manager is an app that stores all your passwords securely and fills them in for you. You remember one strong master password (or use your fingerprint), and it handles the rest.

It can also generate long, random passwords like k8#Qz2!vLm9@pR for every site – which you’ll never need to type yourself.

Option 1: Google Password Manager (easiest for Android users)

If you use Android and Chrome, you already have one.

• On Android: Settings → Google → Autofill → Google Password Manager, or open passwords.google.com in a browser.
• When you sign up or log in on a website in Chrome, it offers to save the password.
• When creating a new account, Chrome can suggest a strong password – just tap it.

It syncs across your phone and computer if you’re signed in with the same Google account.

The catch: everything depends on your Google account being secure. So that account needs a strong passphrase and 2-step verification (see below).

Option 2: Apple Passwords / iCloud Keychain

If you’re fully on iPhone and Mac, Apple’s built-in password manager works similarly.

Option 3: Bitwarden or other dedicated managers

Bitwarden has a solid free tier and works across Android, iPhone, Windows, Mac and all major browsers. It’s a good choice if you use a mix of devices or don’t want everything tied to Google or Apple. Other well-known options exist with paid plans.

Is it safe to keep all passwords in one place?

Fair question. Reputable password managers encrypt your data so that even the company can’t read your passwords. The risk of one well-protected vault is much lower than the risk of reusing the same weak password everywhere.

Just make sure your master password is strong and unique, and you’ve turned on 2-step verification.

Turn On Two-Step Verification (2FA)

Even a strong password can be stolen – through a fake login page, for example. 2FA adds a second check, so a stolen password alone isn’t enough.

Common types, from good to better:

1. SMS OTP – better than nothing, but SMS can be intercepted or your SIM can be swapped by fraudsters.
2. Authenticator app – apps like Google Authenticator or Microsoft Authenticator generate codes on your phone. More secure than SMS.
3. Google prompts / passkeys – tap “Yes, it’s me” on your phone, or use your fingerprint. Easiest and strong.

Start with these accounts:
– Your main email (Gmail/Outlook) – it’s the key to resetting everything else.
– WhatsApp (two-step verification PIN).
– Instagram and Facebook.
– Amazon/Flipkart.
– Your password manager.

Important: when you set up 2FA, save the backup codes somewhere safe (printed, or in your password manager). If you lose your phone, those codes get you back in.

What About Passkeys?

Passkeys are the newer way to log in without passwords – you just use your fingerprint, face or screen lock. Google, Microsoft, Amazon, WhatsApp and several other services support them.

They’re harder to phish because there’s no password to type into a fake website. If a site offers you a passkey, it’s worth trying. You can manage Google passkeys at myaccount.google.com → Security → Passkeys.

Check If Your Passwords Have Been Leaked

• Google Password Checkup: go to passwords.google.com → Password Checkup. It shows passwords that are compromised, reused or weak.
• Have I Been Pwned (haveibeenpwned.com): enter your email to see if it appeared in known data breaches.

If something shows up, change that password – and any other account where you used the same one.

A Simple Plan to Fix Your Passwords This Weekend

You don’t need to fix everything at once.

1. Hour 1: Set up a password manager (Google’s or Bitwarden). Create a strong passphrase for your main email and turn on 2FA.
2. Hour 2: Change passwords for your most important accounts – email, banking-related logins, social media, shopping – to unique generated passwords. Save each in the manager.
3. Over the next few weeks: whenever you log into any other site, update its password to a unique one. Slowly, everything gets fixed.

Habits That Keep You Safe

• Never share OTPs or passwords – no real bank, company or support agent needs them.
• Check the website address before entering a password. Fake login pages look very real.
• Don’t save passwords in a notes app or WhatsApp chat to yourself. These aren’t designed to protect secrets.
• Log out on shared computers – college labs and cyber cafés especially.
• Lock your phone with a PIN, pattern or fingerprint. If someone gets your unlocked phone, they can get into a lot.

FAQ

How long should a password be?
Longer is better. A passphrase of 4 or more random words, or a generated password of 14+ characters, is a good target.

Is Google Password Manager safe?
It’s encrypted and reasonably secure, as long as your Google account has a strong password and 2-step verification.

Should I change my passwords every month?
Not necessarily. Change them when there’s a breach or you suspect a problem. Unique, strong passwords matter more than frequent changes.

What if I forget my password manager’s master password?
For some managers, there’s no recovery. Write it down and keep it somewhere physically safe at home.