Your email inbox is the master key to your online life. Almost every other service, from banks to social networks, sends its password reset links there, so anyone who controls your email can take over the rest of your accounts one by one. That makes the email password the most important password you have, and the one that must never be reused anywhere else.

Choose at least 16 random characters, or a passphrase of five or more random words, and store it in a password manager. Then go beyond the password: Gmail, Outlook and most major providers now support passkeys and authenticator apps, which stop phishing sites from reusing a stolen password. Save the backup or recovery codes your provider gives you somewhere offline, and keep your recovery phone number and recovery email up to date.

Attackers who get into an inbox often stay hidden by adding a forwarding rule or a filter that quietly deletes security alerts. Check your email settings for forwarding addresses and filters you did not create, and review the list of signed-in devices every few months.

Try the generator

20

Your settings are remembered on this device only. Privacy Policy.

Example password patterns

1

Two random words joined with a hyphen, plus a 2-digit number and a symbol — e.g. Word-Word##!

2

A short phrase you'll remember (4 words), separators between each word, no spaces — e.g. Word_Word_Word_Word

3

Acronym from a movie quote or song line + the year you first heard it + a symbol — e.g. FirstLettersYYYY!

4

Three uncommon words concatenated, with a digit and a symbol — e.g. WordWordWord#9

5

Mix of casing and one substitution per word (don't overdo it — substitutions don't add much entropy) — e.g. wOrd-wOrd-99!

6

Let our generator pick the whole string — the most secure option. Click Generate above.

Frequently Asked Questions

What should I do if my email password was leaked?
Change it immediately to a new, unique password, then sign out of all other sessions from your account's security page. Turn on two-step verification or a passkey, check for forwarding rules and filters you did not set up, and update the password on any other account where you used the same one. Finally, review recent security alerts from your bank and social accounts.
Are passkeys better than a password for email?
For most people, yes. A passkey is stored on your device and only works on the genuine website, so it cannot be phished or reused after a breach. Keep a strong password and recovery codes as a backup, because you may need them to set up a new device or recover the account.

Related Tools

Continue your security workflow with these tools