To create a strong password, combine three random words that mean nothing together, such as the NCSC's own example "applenemobiro". Make it long rather than complicated, use a different password for every account, and store them in a password manager. Then turn on two-step verification or, better still, use a passkey wherever one is offered.
Most of us were taught the opposite: eight characters with a capital, a number and a symbol, changed every 90 days. The UK's National Cyber Security Centre (NCSC) has moved firmly away from that approach, because it produced passwords that were hard for people to remember and easy for attackers to guess. This guide sets out the current UK advice for individuals and small businesses, and links to the NCSC sources so you can check them yourself. If you're in the US, NIST's digital identity guidelines (SP 800-63B-4) take the same line: favour length, check new passwords against lists of common and breached ones, and don't impose composition rules or routine password changes.
If you'd rather not think of words yourself, Make It Flow's free password generator creates random passwords and word-based passphrases in your browser.
Key takeaways
- The NCSC recommends three random words for passwords you need to remember, because length and unpredictability beat symbols and number swaps.
- Use a different password for every account; a password manager makes that realistic and only autofills on the genuine site.
- Turn on two-step verification for email first, because whoever controls your inbox can reset everything else.
- Since April 2026 the NCSC recommends passkeys wherever a service supports them, with 2SV as the fallback.
How to create a strong password: the three random words method
The NCSC's headline advice is to use three random words. Its reasoning is simple: longer, more unusual passwords are harder to crack, and three words are long enough to be strong while staying easy to remember.
Its own example is applenemobiro.
Doing it well
- Make the words genuinely random. "Fish chips peas" or "Arsenal north London" are phrases, not random words. Pick words that have no obvious connection.
- Avoid personal details. The NCSC warns against names of family, pets and sports teams, and significant dates, because they're often visible on social media.
- Don't rely on character swaps. Changing
oto0orato@adds little, because attackers' tools try those substitutions automatically. They mostly make the password harder for you to remember. - Add more words for important accounts. Three is the NCSC's minimum suggestion. Four or more random words gives a longer password for your email or password manager.
- Use capitals, numbers or symbols if a site insists. Add them in a way you'll remember, but don't count on them for strength.
Why random words beat "P@ssw0rd1!"
Attackers don't guess passwords one character at a time. They use lists of leaked passwords and common patterns: a capital at the start, a number and an exclamation mark at the end, predictable letter swaps. A password like Summer2026! ticks every complexity box and is still an early guess.
Three unrelated words give an attacker no pattern to exploit, and their length makes brute force impractical.
Length vs complexity
The NCSC's guidance for organisations is direct: it does not recommend complexity requirements for user-chosen passwords. People respond to them with predictable tricks, and attackers know those tricks. Instead, it advises:
| Old approach | Current NCSC approach |
|---|---|
| Complexity rules (upper, lower, number, symbol) | A minimum length, with no maximum length cap |
| Forced changes every 30–90 days | Change only when compromise is known or suspected |
| Block pasting into password fields | Allow pasting, so password managers work |
| Users invent their own passwords freely | Block the most common passwords with a deny list |
| Password alone | Multi-factor authentication on important accounts |
On regular expiry, the NCSC's wording is blunt: "Regular password changing harms rather than improves security." Forced changes lead people to make small, guessable variations on their old password.
If you run a website with user logins, these are good rules for your own sign-up forms too. Our guide to securing your small business website covers the wider picture.
Why you need a different password for every account
Reusing a password is one of the biggest risks for most people, and it matters as much as how strong that password is. When one website is breached, attackers take the leaked email and password combinations and try them automatically on email providers, banks, shops and cloud services. This is called credential stuffing, and it works because so many people reuse passwords.
A strong password reused on ten sites is only as safe as the weakest of those ten sites' security.
Check whether you've been in a data breach
Have I Been Pwned is a free, long-running service that tells you whether your email address appears in known data breaches. If it does:
- Change the password on the breached service.
- Change it anywhere else you used the same or a similar password.
- Turn on two-step verification on those accounts.
- Watch for phishing emails that mention the breached service, because attackers use leaked details to make scams look convincing.
For businesses, a breach of staff credentials can become a reportable personal data breach under UK GDPR. The ICO's guidance on personal data breaches explains when you must report one, usually within 72 hours of becoming aware of it.
Use a password manager
Nobody can remember dozens of unique passwords. The NCSC's password manager guidance recommends them because they let you have a unique, strong password for every service without memorising any of them.
Benefits worth knowing about:
- It generates passwords for you: long, random and unique.
- It helps you spot phishing. As the NCSC notes, a password manager will only autofill on the correct website. If it doesn't offer to fill your bank login, check the address bar.
- It syncs across devices, so you're not tempted to choose something simple to type on your phone.
Built-in or standalone?
Most browsers and phone operating systems include a password manager, and the NCSC says these are a reasonable option. It adds a caveat: passwords stored in the browser are only as secure as your devices and accounts. Standalone managers add features such as secure sharing, which suits small teams sharing logins for a supplier portal or social media account.
Protect the password manager itself
Your password manager's main password is now the most important password you have. Make it four or more random words, never use it anywhere else, and turn on two-step verification for the manager itself.
Turn on two-step verification (2SV)
Two-step verification, also called two-factor (2FA) or multi-factor authentication (MFA), means a stolen password alone isn't enough to get in. The NCSC advises turning on 2SV for all important accounts, even ones with strong passwords.
Which accounts first
Start with your email. Whoever controls your inbox can reset the password for almost everything else. Then move on to:
- Email accounts (personal and business)
- Your password manager
- Banking and payment accounts, including PayPal, Stripe and your card terminal provider
- Your website admin, hosting control panel and domain registrar. Our guide to two-factor authentication for website admin walks through these.
- Social media and Google Business Profile
- Accounting and payroll software
Not all second factors are equal
| Method | Strength | Notes |
|---|---|---|
| Passkey or hardware security key | Strongest | Bound to the real site, so it resists phishing |
| Authenticator app (code or push prompt) | Strong | Codes can still be phished by a convincing fake site |
| SMS text code | Better than nothing | Can be phished or intercepted by SIM-swap fraud |
| Email code | Weakest | Only as safe as the email account itself |
Any 2SV is far better than none. If you're choosing, prefer an authenticator app over SMS, and a passkey or security key over both.
Passkeys: the next step beyond passwords
A passkey replaces the password with a cryptographic key stored on your phone, computer or password manager, unlocked with your fingerprint, face or device PIN. There's nothing to remember, nothing to reuse, and nothing a fake website can capture.
In April 2026 the NCSC announced it would recommend passkeys "wherever a service supports them, and two-step verification (2SV) where it does not". It explained that SMS and app-based codes "are inherently phishable", whereas passkeys are tied cryptographically to the genuine service.
Google, Microsoft, Apple and many other services now offer passkeys. When a site prompts you to create one, it's usually worth saying yes. Keep your password and recovery options in place until you're confident the passkey works on every device you use.
If you run a website or app with customer logins, our guide to passkeys for business websites explains what adding them involves.
Strong password checklist for small businesses
- Use three or more random words for any password you need to remember.
- Never reuse a password across accounts.
- Give staff a password manager and make it the standard way to store logins.
- Turn on 2SV for email, banking, website admin, the domain registrar and the password manager first.
- Switch to passkeys wherever services offer them.
- Remove default and shared passwords on routers, CCTV, card machines and Wi-Fi.
- Drop forced password expiry and complexity rules, and use a deny list of common passwords instead.
- Change passwords promptly when a breach is known or suspected, and when staff leave.
- Check staff email addresses against Have I Been Pwned.
- Review who has access to what at least once a year, and remove old accounts.
If you're working towards Cyber Essentials, these steps line up well with its user access control requirements. Our article on Cyber Essentials 2026 changes covers what's new.
FAQ
What is the NCSC three random words advice?
The NCSC recommends making a password from three random, unconnected words, such as "applenemobiro". The result is long enough to resist guessing and easy enough to remember. Avoid obvious phrases and personal details such as pet names, and add numbers or symbols only if a site requires them.
How long should a strong password be?
The NCSC doesn't set a single figure for individuals. It stresses that longer and more unusual is better, and that organisations should set a minimum length with no maximum cap. Three random words usually gives you a good length. For your email and password manager, use four or more random words.
Do strong passwords need symbols and numbers?
Not necessarily. The NCSC advises against complexity rules because people respond with predictable patterns, such as a capital first and 1! at the end, which attackers try early. Length and randomness matter more. If a website insists on symbols or numbers, add them, but don't rely on them for strength.
Are password managers safe?
The NCSC recommends password managers because they let you use a unique, strong password everywhere and only autofill on the genuine website. No tool is risk-free. Protect the manager with a strong, unique main password and two-step verification, and keep your devices updated, because a manager is only as secure as the device it runs on.
Should I change my passwords regularly?
Not on a fixed schedule. The NCSC says forced regular changes harm security, because people make small, predictable variations on their old password. Change a password when you know or suspect it has been exposed, such as after a data breach, a phishing incident or a member of staff leaving.
Are passkeys better than passwords?
Generally, yes. A passkey can't be reused or guessed, and because it only works on the genuine site, it can't be phished. Since April 2026 the NCSC has recommended passkeys wherever a service supports them, with two-step verification as the fallback. Keep account recovery options up to date in case you lose a device.
Related reading
- Generate a Password from a Word: Build a Strong Passphrase: Want to generate a password based on a word? Why single words with swaps are weak, how to build a strong passphrase around one, and what NIST and CISA advise.
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 27 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
