Your email, Facebook, banking app and Mobile Money account all sit behind a password or PIN, and criminals know that many people still use their birth year, their child's name or "123456". Learning how to create a strong password that you can actually remember is one of the cheapest and most effective ways to protect yourself online.
Why weak passwords are so dangerous
Attackers rarely sit and guess one password at a time. They use automated tools that can try enormous numbers of combinations very quickly, and they use lists of passwords leaked from other websites. This creates three big risks:
- Short or common passwords fall quickly. Words like "password", "kampala" or "jesus" and simple number patterns are among the first things tried.
- Personal details are easy to find. Your birthday, home area, football club or partner's name may already be visible on your social media.
- Reused passwords spread the damage. If you use the same password on a small website that gets hacked and on your Gmail, criminals can try the leaked password on Gmail too. This is called credential stuffing.
Once someone gets into your email, they can often reset the passwords for your other accounts, so your email password deserves special care.
What makes a password strong
A strong password has three qualities:
- Length. Longer passwords are much harder to crack. Aim for at least 12 to 16 characters, and longer for your most important accounts.
- Unpredictability. It should not be based on information people can find or guess about you.
- Uniqueness. Each important account should have its own password.
Mixing upper and lower case letters, numbers and symbols helps, but length and unpredictability matter most. A long phrase made of random words is usually stronger and easier to remember than a short jumble like "Kp@9x".
The passphrase method: strong and memorable
A passphrase is a password made from several unrelated words. Here is how to create one:
- Pick four or five random words that do not form a common saying. For example, imagine a picture: a blue goat riding a boda past a mango tree. That gives you words like blue, goat, boda and mango.
- Join them together with a separator you like, such as a full stop or a number.
- Add a small twist, for example a capital letter in the middle of one word, or a number you will remember that is not your birth year.
- Picture the scene a few times. The odd mental image is what makes it stick.
Do not use the example above, of course. Create your own scene so that nobody else can guess it. Avoid famous song lines, Bible verses and proverbs, because attackers include common phrases in their lists.
A simple system for many accounts
Most people have dozens of accounts, and nobody can remember dozens of passphrases. Here is a realistic approach:
Use a password manager
A password manager is an app that stores all your passwords in an encrypted vault, locked by one strong master passphrase. It can also generate random passwords for you and fill them in on websites and apps. Well-known options include Bitwarden, 1Password and the password managers built into Google Chrome, Android and Apple devices. Several have free plans; check each one's website for current features.
With a password manager, you only need to remember:
- Your master passphrase.
- Your phone's screen lock.
- Perhaps your main email password, as a backup.
Prioritise your most important accounts
If you are not ready for a password manager, start by giving unique, strong passphrases to these accounts first:
- Your main email account.
- Your banking and Mobile Money apps.
- Your social media accounts, especially if you use them for business.
- Your website's hosting control panel and WordPress admin, if you run a website.
Turn on two-factor authentication
Even a strong password can be stolen through a fake login page. Two-factor authentication (2FA) adds a second check, such as a code from an app or a prompt on your phone, before anyone can log in.
To turn it on:
- Open the security settings of the account (Google, Facebook, Instagram, WhatsApp, your hosting account and so on).
- Look for "Two-step verification" or "Two-factor authentication".
- Choose an authenticator app such as Google Authenticator or Microsoft Authenticator where possible. SMS codes are better than nothing, but authenticator apps are generally safer against SIM swap fraud.
- Save the backup codes in a safe place, such as your password manager or a printed sheet stored at home.
For WhatsApp, set a two-step verification PIN under Settings, then Account. This makes it harder for someone to take over your WhatsApp even if they get your SMS code.
Habits that keep your passwords safe
Creating a strong password is only half the job. Protect it with good habits:
- Never share passwords or PINs over the phone, SMS or WhatsApp, even with someone claiming to be from your bank, telecom provider or IT team.
- Check the website address before typing a password. Fake login pages often use slightly misspelled addresses.
- Avoid saving passwords on shared computers, such as those in internet cafes, school labs or office reception desks. Always log out.
- Change a password immediately if you suspect it has been exposed or if a service tells you of a breach.
- Lock your phone with a PIN, pattern or fingerprint. Many accounts are only as safe as the phone they are logged into.
- Do not write passwords on sticky notes on your monitor or in an unlocked notebook at work.
How to check if your password has been leaked
Some free services let you check whether your email address has appeared in known data breaches. The website Have I Been Pwned is a widely used example. Many password managers and browsers, including Google's Password Checkup, will also warn you about passwords that have been exposed or reused. If you get a warning, change that password and any others that were the same.
Frequently asked questions
How often should I change my password?
Modern security advice says you do not need to change strong, unique passwords on a fixed schedule. Change them when there is a reason, such as a breach, a suspected leak or a shared device.
Is it safe to let my browser remember passwords?
On your personal, locked device, a browser's built-in password manager is generally much safer than reusing weak passwords. Protect the device and the account it syncs to with a strong passphrase and 2FA.
What about my Mobile Money PIN?
Treat it like the key to your house. Never share it, avoid obvious numbers like 0000 or your birth year, and cover the keypad when entering it in public.
A strong password does not have to be impossible to remember. Use long passphrases built from vivid, random images, keep them unique for important accounts, add two-factor authentication and let a password manager do the heavy lifting. If you manage a website or business email, apply the same rules to your hosting and email logins; at Baasa Cloud we encourage every customer to switch on 2FA for their client area and cPanel access.