PASSWORDS
Three random words
The NCSC suggests combining three random words, such as applenemobiro, for a password that is long enough and strong enough but easy to remember. Never reuse your email password.
Check an accountWHAT THE NCSC ADVISES
Better keys for
your accounts.
A password is only one lock on the door.
Passwords get guessed, reused and stolen in data breaches. The UK's National Cyber Security Centre recommends a few simple layers: a strong separate password for email, a second step at login, and passkeys where websites offer them.
Check an account Read the short answer
01 Three random words02 A second step at login03 Passkeys where offeredLayers that keep criminals out
THE SHORT ANSWER
Long passwords,
plus a second lock.
Strong passwords help, but they can still be stolen.
Official advice adds layers on top.
2-STEP
A second lock on the door
Turning on 2-step verification is one of the most effective ways to protect your accounts. It keeps criminals out even if they know your password.
Set it up
PASSKEYS
No password to steal
A passkey uses a pair of secrets: your device keeps one, the website the other. The NCSC says passkeys stop phishing and are often 8 times faster than a password and code.
See the numbersA QUICK ACCOUNT CHECK
How well is
the account locked?
Pick the way an account is protected to see what NCSC guidance says about it. The bar shows how strong the protection is.
Based on National Cyber Security Centre guidance for individuals and families. General information, not a security audit.
TWO NUMBERS WORTH KNOWING
Phishing is the threat,
passkeys the answer.
One figure on how accounts are attacked,
one on how much easier passkeys can be.
PHISHING · CYBER SECURITY BREACHES SURVEY 2025
Breached businesses that faced phishing
85<small>%</small>
Of UK businesses reporting a cyber breach or attack in the past year, 85% experienced phishing, the most common and disruptive type. Overall, 43% of businesses reported a breach or attack.
SPEED · NCSC
Passkey login versus password and code
≈ 8<small>× faster</small>
The NCSC says logging in with a passkey is often 8 times faster than using a username, password and two-factor code, while being more secure.
The same government survey found that phishing made up 93% of cyber crimes experienced by businesses that were victims of cyber crime.
FOUR STEPS TO TRY
Start with email,
then the rest.
Your email can reset all your other passwords, so the NCSC suggests protecting it first. Each step takes minutes.
- Give email its own passwordUse a strong password you do not use anywhere else. If you have reused it, change it as soon as possible.
- Turn on 2-step verificationLook in the account's security settings. It may be called 2SV, two-factor authentication or multi-factor authentication.
- Let a password manager rememberIt can generate a unique password for each site and will only autofill on the correct website, which helps against phishing.
- Say yes to passkeysWhen a site offers a passkey, try it. Keep your device updated and back up your recovery options.
WHY PASSWORDS FAIL
Strong is not
the same as safe.
The NCSC says the most common way passwords are stolen is a data breach at an organisation holding your details. Criminals then try those passwords on other accounts, which works because many people reuse them.
Phishing links can also trick people into typing a password into a fake site. A hard-to-guess password is no harder to steal, which is why a second step or a passkey matters.
QUESTIONS PEOPLE ASK
Frequently asked
What is a passkey?
A passwordless login based on public-key cryptography. Your device creates a pair of secrets for each website, keeps one and gives the other to the site, then proves it holds its secret without revealing it.
Is it safe to write my password down?
The NCSC says writing a password down is OK, provided you keep it somewhere safe. It also encourages password managers, which create and remember strong passwords for you.
Are complex passwords with symbols better?
Not necessarily. The NCSC says the old advice to fill passwords with random characters is not helpful, because memorising lots of complex passwords is almost impossible. Three random words are long enough and strong enough for most purposes.
Do I need a mobile phone for 2-step verification?
No. The NCSC says some organisations let you use a landline or other options, and the second step can also be a fingerprint, face scan or an authenticator app.
Which accounts should I protect first?
Start with email, because a criminal with access to it can reset your other passwords. Then banking, social media and online shopping accounts.
SOURCES
Where the facts come from
Each figure on this page comes from the sources below. Check them for the full detail and context.