Coming up with a new password doesn't have to be hard – I'm a password expert, and these are my 5 top tips for crafting the perfect password

In case you weren’t aware, today is World Password Day.

Now, some experts might tell you today that passwords are obsolete and we need to move to new methods of securing accounts. We’re not quite there yet.

It takes time for organizations to make the changes necessary to make passkeys an everyday reality - but until that day comes, we are reliant on passwords.

So, in order to help you keep your accounts secure, I thought that I would share my five top tips for choosing a good password as a password expert.

1. Complex does not mean secure

For a long time, you may have been using a password with a near-unrememberable level of complexity. It might have even been more special characters than normal ones. But as we will explore later, complex does not mean more secure.

The typical rule is that longer passwords are more secure than shorter, complex passwords. Password cracking in the modern world, also known as brute-forcing, requires a computer to go through common password phrases and character combinations in order to guess a password.

The longer the password, the more combinations there are to guess. The more combinations, the longer it takes, exponentially increasing as long as you don’t use a password that is just the letter ‘a’ repeated 12 times.

As NIST guidance explains:

“A one-character password made from lowercase letters would take at most 26 guesses. Adding a second character increases that number to 26 times 26, which is 676 guesses. An eight-character password would take about 200 billion guesses.”

The recommended length for a password in 2026 is at least 15 characters.

2. Link random words

One of the best ways to create a secure password is to link a chain of random words. This makes your password not only memorable, but also long enough to be secure.

For example, NIST guidance uses the example of ‘cassette lava baby’, which is 18 characters long, meaning it will survive 29,479,510,200,013,918,864,408,576 guesses if it is just made of regular lower case characters.

Add in some capitals and special characters, that number gets way bigger.

Flick to a few random pages in a dictionary, choose a few words, and link them together. Boom, you now have your next password.

3. Special characters aren’t always secure

Special characters do add an extra level of complexity to a password, especially if it is a human trying to guess. But they can create predictable patterns.

For example, many people replace regular characters with special characters in recognizable ways. For example, replacing the letter ‘S’ with ‘$’, or ‘A’ with ‘@’. This is especially true when it comes to my next point.

Including special characters does increase the number of possible combinations, but don’t put them in predictable places.

4. Forced password changes cause fatigue

Your organization may enforce password changes every 90 days. But this can push employees into bad habits. We are simple creatures, and we like things to be easy. That’s why when a password change is enforced, we will do as little as possible to change it.

It might be as simple as changing the combination of numbers at the end, or choosing the next in a series of words, such as switching from ‘Monday1234’ to ‘Tuesday1234’. This means that even if the first password is exposed in a data breach and your password is changed to the second one, it gives an attacker a pretty good guess at what the next combination could be.

That is why every password should be unique.

A top tip for organizations that comes straight from NIST: Don’t enforce password changes unless there is evidence of a breach. It frustrates employees and makes them more likely to choose weak combinations.

5. Always use an authenticator

Wherever possible, you multi-factor authentication to secure your accounts. Authenticators help protect accounts by acting as a second method of verification.

Even if someone has your exact combination of username and password, this extra layer of security can stop them in their tracks. This is especially true for phishing attacks. An attacker can weasel your passwords out of you with some trickery and fake login pages, but they can’t put them to use without your chosen method of authentication.

Authentication comes in many forms. It could be a code or link sent to your mobile device, it could be a physical security token such as a YubiKey that needs to be present at login, it could be a biometric factor such as a facial scan or fingerprint, and it could be approving the login through a trusted authenticator app.

So, wherever possible, use multi-factor authentication to keep your accounts as secure as possible.

Our top tips

In conclusion, these are the key tips to making a secure password and keeping your account secure:

1. Use at least 15 characters
2. Use a combination of random words
3. Don’t use special characters in predictable ways
4. Always use a unique password if you are forced to change it
5. Use an authenticator where possible

Extra tips:

• Password managers are excellent tools for securely managing and storing your passwords. They can suggest new passwords using the latest guidance and automatically store and auto-fill them to save you time.
• Password managers aren’t just a place to store them. Many password managers offer dark web monitoring to check for breaches and exposed credentials. You can also check your own credential exposure using a service such as Have I Been Pwned.
• Audit your own credentials. Delete any accounts you no longer use. Not only can they expose your credentials, but the companies you have signed up with can sell or pass on your information to third-parties, putting them at a greater risk of exposure.
• Stay up to date with the latest guidance from NIST.

Expert advice:

As it is World Password Day - the industry's top experts have been offering advice to help businesses and individuals stay secure, and I've rounded up some of the best advice from the experts to help secure your accounts.

Adrian Podkaminer, Head of Security at G2A.COM says:

"As World Password Day approaches, it is a timely reminder that in today’s digital economy, where gaming, commerce, and payments all happen online, protecting digital identity is central to security. Recent industry reporting shows that compromised credentials and other identity-based attacks remain among the most common paths to account compromise and broader security incidents.

Weak or reused passwords are still one of the primary attack vectors, but the threat landscape is also evolving through AI-enabled phishing and social engineering. Threat actors are increasingly using generative AI to scale credential-harvesting campaigns, create more convincing impersonation attempts, and produce fraudulent communications that are harder to distinguish from legitimate ones. AI does not fundamentally change how passwords are cracked; it makes stealing them through deception more efficient.

For users of digital marketplaces and gaming platforms like G2A.COM, that means moving beyond password-only habits. Using a unique password for every service, storing credentials in a reputable password manager, enabling multi-factor authentication, and staying cautious around unexpected login links, urgent prompts, or offers that seem too good to be true can significantly reduce risk. Where available, phishing-resistant authentication methods offer an even stronger layer of protection.

At G2A, we follow “Zero Trust” principles alongside real-time fraud detection, secure payment controls, seller verification and marketplace risk controls. Cybersecurity is a shared responsibility and a continuous process, not a static destination. World Password Day is a useful reminder that both platforms and users need to keep strengthening how they protect accounts and digital identity."

Steven Furnell, senior IEEE member and professor of cybersecurity at the University of Nottingham says:

“The NCSC’s recommendation to use passkeys 'wherever a service supports them' is good from both security and usability perspectives. Passkeys have been specifically designed to overcome our primary problems with passwords.

However, the ‘wherever supported’ aspect is a potential challenge, because many users won’t be able to follow the guidance uniformly or consistently across the services they use. Many sites and services still don’t offer passkey support, so users will find themselves with a mixed login experience.

It’s still the correct advice, but no matter how good passkeys are, we need to recognise that this is going to be a long game rather than flipping a switch.

Where passwords are still in use, it’s far too easy to find sites that fail to support the user in two significant and fundamental ways, by asking them to create new passwords while providing little or no tangible guidance on how to do so securely, and/or allowing them to get away with making choices that would generally be regarded as weak.

While some might argue that it’s the user’s responsibility to protect themselves properly, they need to know how to do it. Where are they supposed to get this knowledge if the sites don’t offer it? Why would the user even suspect there’s a problem if the site lets them choose a poor password without complaint?

This World Password Day, the main message ought not to be to the users, who often have no choice but to use passwords anyway, but to the sites and providers that are requiring them to do so.”

Stuart Sharp, Vice President of Product at OneLogin says:

“The most effective password may be no password at all. World Password Day has started to feel ironic because most people already know that passwords are a problem. We’ve spent years telling users to create longer passwords, avoid reusing them, rotate them regularly, and add more layers of authentication on top, but the reality is that passwords still create friction for users and opportunity for attackers. We’ve all been there – people forget them, reuse them, write them down, or work around security policies altogether because the process of managing passwords effectively feels admin-heavy. For years now organizations have been moving toward passwordless authentication like on-device biometrics, and more recently passkeys. If the number one goal is security, we have to reduce our reliance on a system that was never really designed for the way we work today.

Passkeys are a step up because they improve security while at the same time making authentication feel more natural for users. Instead of having to remember a convoluted password, passkeys allow authentication to be tied to a user’s device or their own biometric signals, such as a fingerprint, facial recognition, or device-based credential. With passkeys, we’re finally starting to see authentication move to where it should be – a seamless process that doesn’t interrupt your flow every time you launch an app.

Having said that, passwords aren’t going to disappear overnight. Most companies are still operating across a mix of legacy systems and unmanaged devices, so the full transition to passkeys will happen gradually – but it will happen. In many ways, passwords are starting to feel like a set of physical keys we have to carry – just like physical keys, you need a different one for every digital service you use. They’ve been with us for decades, so they’re accepted as normal, but that doesn’t make them the best fit for how we work today. World Password Day exists to raise awareness about good password hygiene and security practices, but as security becomes more of a fluid, embedded, background process, the need to raise awareness will diminish – because security will simply be designed into whatever process we’re using.

Next year, rather than reminding people to manage passwords better, we should celebrate a future without them.”

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.