Most people's password is a pet's name, a birthday and an exclamation mark. Attackers know that. They also know the favourite trick: swap an o for a 0 and call it clever.

The UK's National Cyber Security Centre (NCSC) suggests something duller and stronger. Combine three random words (its example is applenemobiro). It says weak passwords can be cracked in seconds and that the longer and more unusual a password is, the harder it is to crack. This guide is for anyone who shops online and wants to protect their shopping accounts.

Quick answer

  • The NCSC suggests combining three random words for a password that is long enough and strong enough to remember.
  • Give your email a strong password you use nowhere else, and set up two-step verification on it.
  • The NCSC says to make passkeys your first choice wherever they are offered.

What to avoid

  • Common passwords such as "password".
  • Significant dates, and the names of loved ones, pets or favourite teams. Social media often shows them.
  • Simple character swaps like "o" to "0". They add little strength.

Writing a password down is acceptable if you store it securely.

Protect your email first

Your inbox is the master key. If criminals get in, they can read private details (including banking information), send messages that look like they came from you and reset the passwords on your other accounts. So give your email a password that appears nowhere else. If you ever reused it, change it today.

Then give each important account (banking, shopping, social media) its own password, and set up 2-step verification on your email account, which the NCSC says prevents a criminal from accessing it even if they know your password.

Passkeys and 2-step verification

The NCSC's password manager page (reviewed 21 May 2026) calls turning on two-step verification the first and most important step. It also says many sites now let you sign in with a passkey, which uses your device's unlock method such as a fingerprint or passcode, and that it recommends making passkeys your first choice wherever they are offered. For accounts without passkeys, keep a strong, unique password and two-step verification.

Password managers

The NCSC says a manager stores passwords safely so you can have a unique one for each service, and often offers automatic password generation, autofill, syncing across devices and warnings that a password has been breached. It says autofill also helps protect against phishing because the password only fills in on the correct website. The NCSC says built-in browser or device managers suit your own devices, especially if you stay with one browser or system; third-party managers are better if you mix devices. Never save passwords on shared or public computers. The NCSC says passwords saved in the browser are only as secure as your devices and accounts, so keep automatic updates on. It also advises turning on two-step verification for the password manager account.

If you forget your primary password, the NCSC says many managers offer recovery options such as secure hints or emergency access through trusted contacts.

We do not recommend a particular manager.

What to check before you buy

  • Is my email password unique, and have I turned on two-step verification there?
  • Does each important account (banking, shopping, social media) have its own password?
  • Am I saving passwords only on my own devices, never on shared or public computers?
  • Is automatic updating switched on for my browser and operating system?

Last checked: 21 October 2026. General information, not legal, medical or financial advice. Sources: NCSC, three random words; NCSC, strong and separate password for email; NCSC, password managers (the three-random-words page reviewed 21 December 2021, the email page reviewed 21 December 2021 and the password manager page reviewed 21 May 2026; all read 21 October 2026).