The internet is a fantastic tool, but keeping your accounts safe on it can feel like a chore. That’s why, as part of our 101 series, we’re breaking down one of the simplest yet most important parts of online security: your passwords.
Every year on World Password Day (the first Thursday of May), security experts remind us how much rests on those few characters. But a strong password is only the start. Modern digital hygiene means layering on extra protection too. Here’s how to do it, in plain English.
Why weak passwords are so dangerous
Simple, easy-to-remember passwords aren’t just convenient for you, they’re convenient for attackers too. Weak passwords are quick to guess and easy for hacking software to brute-force.
The problem is that information once known only to your close circle is now public. Birthdays, anniversaries, pet names, your favourite team, your car. If you’ve shared it online, someone can find it and try it. (This is also why it’s worth setting your social media accounts so only approved friends and followers can see your personal details.)
Just how predictable are we? Here are the ten most common passwords found in data breaches worldwide, according to password manager NordPass’s 2025 report:
| Rank | Password | Times found in breaches |
| 1 | 123456 | ~21.6 million |
| 2 | admin | ~21.0 million |
| 3 | 12345678 | ~8.3 million |
| 4 | 123456789 | ~5.7 million |
| 5 | 12345 | ~3.9 million |
| 6 | password | ~3.5 million |
| 7 | Aa123456 | ~2.5 million |
| 8 | 1234567890 | ~1.4 million |
| 9 | Pass@123 | ~1.2 million |
| 10 | admin123 | ~1.1 million |
The vast majority of these can be cracked in under a second. And notice entries like Aa123456 and Pass@123: adding a capital letter and a symbol to a common word makes a password look strong, but if the pattern is common, it isn’t. Real strength comes from length and unpredictability, not from decorating a weak word.
How to create a strong password
The single biggest factor in password strength is length. A longer password has exponentially more possible combinations, which makes brute-forcing impractical.
The easiest way to get length without a headache is a passphrase: four or more random, unrelated words strung together (think unexpected combinations you’d never find in a sentence). These are long, hard to crack, and far easier to remember than a jumble of symbols. Aim for at least 12–16 characters, and mix in uppercase and lowercase letters, numbers and symbols where you can.
Not sure where to start? A reputable password generator can create a strong, random password for you in one click.
Use a password manager
Gone are the days of remembering every password or worse, writing them on a sticky note. A password manager securely stores all your logins behind one strong master password, and can generate unique passwords for every account.
A few well-regarded options our team has used:
- Bitwarden: free, open-source, and available on every platform
- 1Password: a polished paid option with great family and team features
- KeePassXC: free and open-source, storing your vault locally on your own device
Never reuse the same password
Even with a long, random password, you should never use it for more than one account. Here’s why: if a single site suffers a data breach, attackers will try that same password everywhere else: a trick called credential stuffing. One leak can unlock your email, your banking and your socials in minutes.
Want to know if your details have already appeared in a breach? Free services like Have I Been Pwned let you check any email address against known leaks.
Add multi-factor authentication (MFA)
A password is one lock on your door. Multi-factor authentication (MFA/2FA) adds a second, so even if someone steals your password, they still can’t get in. When an account offers it, turn it on. Your options, from basic to strongest:
| Method | How it works | Security level |
| SMS code | A one-time code texted to your phone | Basic (better than nothing) |
| Authenticator app | A rotating code generated on your device | Strong, recommended for most |
| Hardware security key | A physical key you plug in or tap | Strongest |
For most people, an authenticator app hits the sweet spot of security and convenience.
The future is passwordless: passkeys
You may have noticed some services now offer passkeys. Instead of a password you type, a passkey uses your device’s fingerprint, face or PIN to sign you in securely, nothing to remember, and nothing to steal in a breach. Major platforms like Google, Apple and Microsoft now support them, and they’re well worth using wherever they’re offered.
Time it takes a hacker to brute force your password in 2026
Hardware: 16 x RTX 5090 | Password hash: bcrypt (10) | Source: Hive Systems, hivesystems.com/password
| Characters | Numbers only | Lowercase letters | Upper and lowercase letters | Numbers, upper and lowercase letters | Numbers, upper and lowercase letters, symbols |
|---|---|---|---|---|---|
| 4 | Instantly | Instantly | Instantly | Instantly | Instantly |
| 5 | Instantly | Instantly | 46 mins | 2 hours | 3 hours |
| 6 | Instantly | 37 mins | 2 days | 5 days | 1 week |
| 7 | Instantly | 16 hours | 3 months | 10 months | 2 years |
| 8 | Instantly | 2 weeks | 12 years | 50 years | 132 years |
| 9 | 2 hours | 1 year | 636 years | 3k years | 9k years |
| 10 | 20 hours | 32 years | 33k years | 191k years | 645k years |
| 11 | 1 week | 839 years | 1m years | 11m years | 45m years |
| 12 | 3 months | 21k years | 89m years | 737m years | 3bn years |
| 13 | 2 years | 567k years | 4bn years | 45bn years | 221bn years |
| 14 | 23 years | 14m years | 241bn years | 2tn years | 15tn years |
| 15 | 229 years | 383m years | 12tn years | 175tn years | 1qd years |
| 16 | 2k years | 9bn years | 653tn years | 10qd years | 75qd years |
| 17 | 22k years | 259bn years | 33qd years | 675qd years | 5qn years |
| 18 | 228k years | 6tn years | 1qn years | 41qn years | 372qn years |
Abbreviations: k = thousand, m = million, bn = billion, tn = trillion, qd = quadrillion, qn = quintillion.
Frequently asked questions
What makes a password strong? Length above all. Aim for at least 12–16 characters, ideally a passphrase of random words, and never reuse it across accounts.
Are password managers safe? Yes. A reputable password manager is far safer than reusing weak passwords or storing them in a browser or on paper.
Do I still need a strong password if I use MFA? Absolutely. MFA is a second layer, not a replacement. The two work best together.
Keep your accounts secure
Good password habits protect everything you do online, including your Domain Central account and the domains, hosting and email you rely on. Secure your Client Area login with a strong, unique password and MFA, and if you’d like a hand with account security or an SSL certificate to protect your website’s data, our friendly team is here to help.
