How long should a password be? What CISA recommends

Concerns & risks

You use short variations of the same password on many sites, and your bank is asking for a new one.

Causes & evidence

CISA's Secure Our World guidance says strong passwords are long, random and unique. It recommends passwords of at least 16 characters, created either as a random string of mixed characters or as a passphrase of random words. Each account should have its own password, because when one site is breached, attackers try the same email and password on other sites, a technique known as credential stuffing. Pet names, birthdays and simple variations like adding a number are easy to guess. CISA recommends using a password manager to create and store unique passwords, so you only need to remember one strong master password, and turning on multifactor authentication wherever it's offered for extra protection. Where available, passkeys can replace passwords on some sites. Prioritize email, banking and any account that can reset others.

Edge cases: some sites still cap password length or ban certain symbols. Passkeys, where offered, let you sign in with your device and fingerprint or face, and can't be phished like passwords. Security questions should be treated like passwords, with random answers saved in your manager.

Reusing one password with small variations means a single breach can unlock many of your accounts.

What to do

1. Choose a password manager and set a long, unique master passphrase.
2. Change your email password first, since it can reset other accounts.
3. Change banking and financial passwords next, using 16+ random characters.
4. Turn on multifactor authentication for email, banking and social media.
5. Replace reused passwords on other accounts over the next few weeks.

Common mistakes:

• Adding a number to an old password
• Using one password everywhere
• Stopping at the site's minimum length
• Writing passwords in an unprotected note

ReportSpeedMan tip: If a site limits passwords to fewer than 16 characters, use the maximum it allows and make sure MFA is on.

What I would actually do

I'd set up a password manager this week, change my email password first and turn on MFA for email and banking before moving on to other accounts.

The trade-off people miss: a password manager puts many keys in one place, so its master password and MFA must be strong. Done right, it's far safer than reusing one memorable password.

How to know it worked

Your key accounts have unique 16+ character passwords and MFA.

Quick FAQ

Is writing passwords down safe?
A locked physical notebook at home is safer than reuse.

How often should I change passwords?
When there's a breach or sign of misuse.

Is a browser password manager okay?
Yes, if protected by a strong account password and MFA.

Wrap-up: CISA recommends passwords of at least 16 random characters, unique for every account. Use a password manager, start with email and banking, and add MFA.

Wiki: Multi-Factor Authentication (MFA) and Identity Theft Recovery Steps.

How long should a password be: official pages behind this answer

• CISA: Use strong passwords
• CISA: Turn on MFA