Password guidance

Creating strong passwords is one of the simplest ways to protect your University account and data.

The National Cyber Security Centre (NCSC) recommends using multiple random words to create passwords that are both secure and easy to remember.

Create strong passwords

1. Use three or more random words – create your password using a sequence of random words. Longer passwords are harder to crack but easier to remember. See the NCSC guidance for more information.
2. Aim for at least 16 characters – length is one of the most important factors in password strength.
3. Avoid common or obvious passwords – passwords such as "password", "qwertyuiop" or simple variations are easy to guess and are commonly used in attacks.
4. Avoid personal information – don't use names of family members, pets, dates of birth, sports teams or other information that could be found about you online or on social media.
5. Avoid predictable substitutions – replacing letters with numbers or symbols, such as changing "o" to 0" or "i" to "!", does not greatly improve security. Attackers can automatically try common substitutions, and they can make passwords harder to remember.

Curious about which passwords are most commonly used? See examples of commonly leaked passwords

Manage your passwords safely

1. Use a different password for every account – if one password is exposed, this helps prevent attackers from using it to access your other accounts.
2. Use a password manager – password managers can generate strong, unique passwords and store them securely, so you don't have to remember them all.
3. Store passwords securely – never leave passwords where other people can see them. If you need to write a password down temporarily, store it somewhere secure and away from the device it protects. Better still, use a password manager.

Protect your account

1. Use multi-factor authentication (MFA) – MFA adds an extra layer of security and can help protect your account even if your password is compromised.
2. Never share your password or MFA code – the ICT Service Desk or your colleagues will never ask for your password or MFA code.
3. Be aware of phishing attempts – be cautious of emails or messages that try to trick you into revealing your login details. If something doesn't look right, stop and check before entering your password.
4. Always lock your device when you leave it – this helps prevent unauthorised access, particularly when working in shared or public areas. On Windows, press Windows key + L. On a Mac, press Control + Command + Q.

Following these steps helps protect your account and University data from unauthorised access.