Strong Passwords Made Simple: CISA's Long, Random, Unique Rule and Why to Use a Password Manager
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A plain-English summary of CISA's Secure Our World: Use Strong Passwords page (marked by CISA as archived content) and the FTC's two-factor guidance, checked October 29, 2026. We don't name or compare specific password managers.
CISA's three tests
A strong password passes all three:
- Long: at least 16 characters. Longer is stronger.
- Random: either a random mix of upper- and lowercase letters, numbers and symbols, or a passphrase of 4–7 unrelated words (spaces are fine).
- Unique: a different password for every account.
Never use birthdays, pet names or sequences like 12345.
Why "unique" matters most
The FTC explains that criminals buy usernames and passwords stolen in data breaches and try them on other sites. If you reuse a password, one breach unlocks several accounts. If a company tells you your data was exposed, change that password right away.
Let a password manager do the work
Nobody can remember dozens of random 16-character passwords. CISA recommends a password manager, a program that:
- Generates strong passwords
- Stores them, encrypted
- Fills them in for you
- Warns you about weak or reused passwords
You only remember one strong passphrase: the one for the manager itself. CISA notes some are free, including the ones built into web browsers, and some are paid. CISA also says not to keep passwords in a plain file on your computer.
A 30-minute home office plan
- Pick a password manager and create a long passphrase for it.
- Change the passwords on your email first. Email resets everything else.
- Then change banking, payroll, tax and payment apps.
- Turn on two-factor authentication for each (see two-factor authentication).
- Where sites offer passkeys, consider them (see passkeys explained).
- Set up account recovery options (see account recovery setup).