How to Choose a Strong Password Without Losing Your Mind

Passwords are supposed to keep our accounts safe. But somewhere along the way, they also became a test of our patience.

Create a password with 12 characters. Add a capital letter. Add a number. Add a symbol. Don't use the same password twice. Don't write it down. Don't forget it. Oh—and remember which version you used for each of the dozens of accounts you access.

Sound familiar?

The good news is that creating strong passwords doesn't have to be quite so complicated. In fact, some of the old password advice you may have heard isn't necessarily the best approach anymore. 

Here are some practical ways to create stronger passwords, protect your accounts, and save yourself from constantly clicking "Forgot Password?" 

 

Start with Length

When it comes to creating a strong password, longer is generally better.

Current guidance from the National Institute of Standards and Technology (NIST) recommends passwords of at least 15 characters when you're creating one yourself.

That doesn't mean you need to memorize a random jumble of 15 letters, numbers, and symbols.

Instead, consider using a passphrase—a combination of several unrelated words that's long but easier for you to remember.

The important word there is unrelated. Avoid phrases someone could easily associate with you, such as your child's name, favorite sports team, hometown, birthday, or pet's name.

Long and memorable can be a lot easier to manage than short and complicated.

InRoads members should also be familiar with our recent Digital Banking password requirement changes.

 

Stop Recycling Your Passwords

We get it. You finally created a password you can remember, so why wouldn't you use it everywhere? 

Because one compromised password could potentially give a scammer the keys to several of your accounts. 

When criminals obtain usernames and passwords from a data breach, they may try those same credentials on other websites. If you've reused your password for your email, favorite shopping site, streaming account, and financial accounts, one exposed password can create a much bigger problem. 

Every important account should have its own unique password. 

And no, changing MyPassword1! to MyPassword2! doesn't really count.

 

Let a Password Manager Remember for You

If you're thinking, "There's absolutely no way I'm going to remember a different 15-character password for every account I have," you're right. 

You don't have to. 

A password manager can generate strong, unique passwords for your accounts and securely store them for you. Instead of remembering dozens of passwords, you primarily need to protect the credentials that unlock your password manager. 

When choosing a password manager, look for a reputable provider and features such as:

● Strong encryption and security practices 
● Multi-factor authentication 
● Compatibility with the devices and browsers you use 
● Automatic password generation 
● Autofill capabilities 
● Alerts about weak, reused, or potentially compromised passwords 

There may be a little setup involved initially, but once your accounts are organized, a password manager can make good password habits significantly easier to maintain.

Turn On Multi-Factor Authentication

Even a great password shouldn't have to do all the work. 

Multi-factor authentication (MFA) adds another layer of protection by requiring an additional way to verify that it's really you trying to access an account. 

Depending on the service, that might mean using an authentication app, security key, passkey, biometric verification, or a code sent to a trusted device. 

So even if someone manages to steal your password, they may still be unable to access your account. 

Whenever MFA is available—especially for your email, financial, social media, and other important accounts—turn it on.  

 

Don't Make Your Password Personal

Your password shouldn't tell your life story. 

Names, birthdays, anniversaries, addresses, phone numbers, favorite teams, and pet names may be easy for you to remember—but they may also be surprisingly easy for someone else to discover. 

Think about how much information we routinely share online. A quick look through someone's social media account can reveal family names, pets, birthdays, favorite vacation destinations, schools, and hobbies. 

That's why a seemingly clever password based on personal information may not be nearly as clever as it feels. 

Choose something that isn't connected to information someone could learn about you. 

 

Don't Automatically Change a Good Password Just Because It's Old

Remember when we were told to change our passwords every 30, 60, or 90 days? 

Constantly changing passwords can sometimes lead people to create predictable variations because remembering an entirely new password every few months is difficult. 

Instead, focus on creating a strong, unique password from the beginning. 

You should absolutely change a password if you learn that it has been compromised, if you accidentally shared it, or if you have reason to believe someone else may have access to your account. 

Otherwise, don't weaken a good password simply because the calendar says it's time to invent another one.  

Watch Out for Phishing  

Here's the frustrating part: you can create an incredibly strong password and still hand it directly to a scammer. 

Phishing emails, texts, calls, and fake websites are designed to trick you into providing login information yourself.

Be cautious anytime you're unexpectedly asked to enter a password or verify an account. Instead of clicking a link in an unsolicited message, go directly to the company's website or open its official app.

And remember: InRoads will never contact you and ask for your Digital Banking password. 

Strong passwords work best when they're paired with healthy skepticism.

What About Passkeys?

You may also be seeing more websites and apps offering passkeys as an alternative to traditional passwords. 

Passkeys allow you to verify your identity using a device you already have, often through a fingerprint, face scan, PIN, or another device-based authentication method. They can also provide better protection against phishing because there isn't a traditional password for you to accidentally hand over to a scammer. 

Not every account supports passkeys yet, so passwords aren't disappearing tomorrow. But when a trusted service offers a passkey option, it's worth learning more about it. 

 

Your Password Sanity Checklist 

You don't need to become a cybersecurity expert to make your accounts significantly harder to break into. 

Remember these basics: 

Make it long. Aim for at least 15 characters when creating your own password. 

Make it unique. Don't reuse passwords across accounts. 

Make it impersonal. Skip birthdays, names, pets, addresses, and other easily discovered information. 

Let technology help. Consider using a reputable password manager to create and store unique passwords. 

Add another layer. Turn on multi-factor authentication whenever it's available. 

Stay skeptical. A strong password can't protect you if you give it to a scammer.

 

Stronger Security Without the Headache 

Creating better passwords doesn't mean memorizing increasingly complicated strings of characters. 

The goal is actually to make security easier to maintain: longer passwords, a different one for every account, a password manager to remember them, and multi-factor authentication for an extra layer of protection. 

A few changes now can save you from a much bigger headache later—and that's one password habit worth remembering. 

At InRoads Credit Union, helping you protect your financial information is an important part of helping you protect your financial well-being. Visit our Fraud Prevention resources for more tips on recognizing scams, protecting your accounts, and keeping your personal information safer.