How to create a strong password and keep your business safe

Most hackers don't break in. They log in. A weak, reused or stolen password is still the easiest way into a business, and fixing it takes about ten minutes. Here's what a strong password looks like in 2026, the habits that actually protect you, and a checklist you can run through with your team today.

• 43%of UK businesses had a breach or attack

  In the last 12 months, according to the UK government's Cyber Security Breaches Survey 2025/2026.

• 15+characters

  The minimum length the US standards body NIST now sets for a password used on its own, in SP 800-63B-4 (2025).

• 3random words

  The UK National Cyber Security Centre's recommended way to make a password that's long and memorable: three random words.

Key takeaways

• Length beats complexity. Three random words beat a short jumble of symbols.
• Never reuse a password. One leak shouldn't unlock everything else.
• Use a password manager so you only have to remember one strong password.
• Turn on two-step verification (2SV) for email, banking and anything with customer data.
• Switch to passkeys wherever a service offers them.
• Nobody needs your password. Not IT, not your bank, not us.

Your password is only as safe as the people who know it

Security testers, the people businesses pay to try to break in, often start at reception rather than at a keyboard. A typical test goes like this:

1. Find out the name of the head of IT from LinkedIn or the company website.
2. Walk into reception: "Hi, I'm from ACME IT. Sarah asked us to check your network. Could I use this computer for a moment?"
3. "Would you mind logging in for me?" Then: "This may take a while. Grab a coffee, but just tell me the password so I don't have to disturb you."

Wanting to help, the receptionist hands it over, and the tester is in. From one login, an attacker can often reach email, shared files and customer records.

The same trick works by phone, email and text message. That's why the first rule is the simplest: your password is yours, and no one has a right to it. Real IT staff, banks and suppliers will never ask for it.

How passwords actually get stolen

What makes a strong password in 2026

Password advice has changed. Rules many of us were taught, like forced symbols and changing passwords every 90 days, made passwords harder to remember without making them much harder to crack. The UK's National Cyber Security Centre (NCSC) and the US standards body NIST now agree on a simpler approach.

How to create a strong password with three random words

1. Pick three words that have nothing to do with you

   Look around the room, open a book at a random page, or let your password manager choose. Avoid names, places, dates and anything you've posted online. Something like lantern, otter, gravel works. Song lyrics and famous phrases don't, because attackers' word lists include them.

2. Join them together

   LanternOtterGravel is 18 characters, long enough to meet NIST's minimum, and still easy to type and remember.

3. Add a number or symbol only if a site insists

   Some older systems still demand them. Add one somewhere unexpected, not a 1 or ! at the end where everyone puts it.

4. Use it once

   Every account gets its own three words. This is where a password manager stops this from getting impossible.

Don't use the examples on this page. Anything published online can end up in an attacker's word list. Make up your own. The NCSC's guide to a strong, separate password for your email explains why your email password matters most.

Use a password manager

Nobody can remember 50 unique passwords, and you shouldn't have to. A password manager creates a strong, random password for each account, stores it encrypted and fills it in for you. You only need to remember one strong password to unlock it (make that one three random words).

Good options include the managers built into Apple, Google and Microsoft devices, and dedicated apps such as 1Password, Bitwarden and Dashlane. For a business, choose one with shared vaults, so staff can share logins safely and you can remove someone's access in one click when they leave.

A password manager also helps protect you from phishing. It won't fill in your Microsoft password on a fake site, because the web address doesn't match.

Turn on two-step verification

Two-step verification (2SV, also called two-factor authentication or 2FA) asks for a second proof after your password: a code from an app, a tap on your phone or a security key. Even if someone steals your password, they still can't get in without it.

Turn it on first for the accounts that would hurt most if lost:

• Email (Microsoft 365, Google Workspace). Whoever controls your email can reset every other password.
• Online banking and payment accounts
• Your website, domain and hosting accounts
• Accounting software, CRM and anything holding customer data
• Social media accounts that represent your business

An authenticator app (Microsoft Authenticator, Google Authenticator) is safer than text message codes, which can be intercepted if someone takes over your phone number.

Passkeys: logging in without a password

Passkeys are the newer, safer replacement for passwords, and Microsoft, Google, Apple, Amazon and many banks now support them. Instead of typing a password, you confirm it's you with your fingerprint, face or phone PIN. There's nothing for anyone to guess, reuse or type into a fake website.

If a service offers to set up a passkey, say yes. Keep a strong password and 2SV on accounts that don't offer them yet.

Has your password already been leaked?

Check your email addresses at Have I Been Pwned, a free service run by security researcher Troy Hunt. It tells you if an address has appeared in a known data breach, and you can sign up to be alerted if it does in future. Its domain search can also check every address on your business domain.

If an account shows up, change that password, and any other account where you used the same one, and turn on 2SV.

A 10-minute checklist for your business

How we protect the passwords on websites we build

You're only half of the equation. Every website or system that holds your password has to look after it properly, and not every developer does. A badly built site might store passwords as plain text, ready to be read by anyone who breaches it.

On websites built on Hydra CMS, the content management system we develop, passwords are never stored. Hydra keeps a bcrypt hash: a one-way, salted, scrambled fingerprint that can check a password but can't be turned back into one. Signing in from a browser Hydra hasn't seen before also needs a one-time PIN sent by email, login attempts are rate-limited, and staff can sign in with their Microsoft or Google account instead of another password.

If you're not sure how an existing website or system of yours stores passwords, it's worth asking whoever built it.

Frequently asked questions

Need help securing your business?

We build secure websites and cloud business systems for businesses across Dorset and the UK. If you'd like a second opinion on how your website or systems handle passwords and logins, get in touch for a free, no-obligation chat.

Talk to us about security Website design