How to Create a Strong Password With Three Random Words

The UK National Cyber Security Centre (NCSC) publishes guidance showing how to build a password by combining three random words, as part of its "Top tips for staying secure online" collection. Following the steps below, taken from that NCSC page, you can create a password the agency describes as "long enough and strong enough" for most purposes.

What it does

The NCSC says weak passwords can be cracked in seconds, and that the longer and more unusual a password is, the harder it is for a cyber criminal to crack.

According to the agency, combining three random words creates a password that will be "strong enough" to keep criminals out, but easy enough for the user to remember. The NCSC gives applenemobiro as an example of such a password.

The guidance is written for "You & your family" and is version 2.0, published and reviewed on 21 December 2021.

Before you start

The NCSC does not list technical requirements for this method. The only thing you need is to pick words yourself, or, as an alternative, use a password manager.

The agency says a password manager can create strong passwords for you and remember them.

Steps

Step 1: Combine three random words to create your password. The NCSC gives the example applenemobiro.

Step 2: Alternatively, use a password manager, which the NCSC says can create strong passwords for you and also remember them.

Step 3: Avoid the most common passwords that criminals can easily guess, such as 'password'.

Step 4: Avoid building passwords from significant dates, such as your birthday or a loved one's, from your favourite sports team, or from family and pet names. The NCSC says most of these details can be found within your social media profile.

Step 5: Do not rely on character substitutions, such as swapping the letter 'o' with a zero. The NCSC says cyber criminals know these tricks as well, so the password will not be significantly stronger but will be harder for you to remember.

Step 6: If you want to write your password down, the NCSC says that is also OK, provided you keep it somewhere safe.

What the agency says

The NCSC argues that longstanding advice around making passwords very complex — full of random characters, symbols and numbers — is not helpful, because most people have lots of passwords and memorising many complex ones is almost impossible.

Passwords generated from three random words are, in the agency's words, a good way to create unique passwords that are "long enough" and "strong enough" for most purposes but can also be remembered much more easily.

The page also points readers to a blog by one of the NCSC's technical experts that further explains the thinking behind the technique.

What to do

• Build your password by combining three random words, as in the NCSC's applenemobiro example.
• Consider a password manager, which the NCSC says can create and remember strong passwords for you.
• Avoid common guessable passwords such as 'password'.
• Do not base passwords on birthdays, sports teams, family or pet names, which the NCSC notes can often be found on your social media profile.
• Skip character substitutions like replacing 'o' with a zero; the NCSC says criminals know these tricks.
• If you write a password down, keep it somewhere safe.

Read the original from UK National Cyber Security Centre →