Home › Safety

Passwords made simple: one strong password, and let an app remember the rest

You don't need to remember 30 passwords. Government security experts at CISA suggest a simpler plan: make one long password you can remember, and let a password manager remember the rest.

Checked against official help pages on October 22, 2026.

Quick answers

What makes a strong password?

CISA says long (at least 16 characters), random and different for every account. A string of 4 to 7 unrelated words works well.

What is a password manager?

An app that creates, saves and fills in your passwords. You only remember one password: the one that opens the manager.

Is the password saver in my browser okay?

CISA says some password managers are free, like the ones built into web browsers. Others cost money.

What's the extra code they text me?

That's multi-factor authentication. CISA says turn it on, especially for email, banking and social media.

Make one strong password

Pick 4 to 7 words that have nothing to do with each other, like a sentence that makes no sense. Spaces are okay.
Make sure it's at least 16 characters long.
Don't use names, birthdays or anything on your social media.
Use it for one thing: your password manager, or your main email if you're not using a manager yet.

Tip

Don't copy any example password you've seen online, including on this page.

Let a password manager remember the rest

CISA says most people can't remember a long, different password for every account, and suggests a password manager instead of writing them in a file. It can also warn you about weak or reused passwords.

iPhones and iPads on iOS 18 or later have a built-in Passwords app. Apple says it can suggest strong passwords, fill them in, and warn you about weak or reused ones. Many web browsers have a password saver too. Choose a manager that supports multi-factor authentication, as NIST recommends.

Turn on the extra code

Multi-factor authentication means a second check, like a code or your fingerprint, after your password. Turn it on for email, banking and social media first.

Never read a code out to someone who calls you. Real companies won't ask for it.

Where this comes from

We checked these official pages on October 22, 2026:

Menus can change after updates. If a step doesn't match your screen, tell us and we'll fix it.