Click your name in the top right and choose Change Password. You will need your current password to set a new one.
What actually makes a password strong
Most password advice is decades out of date. Complexity rules produced passwords that were hard for humans and easy for machines. Three things matter:
- Length. Fifteen characters of anything beats eight characters of chaos. Length defeats brute force far more effectively than punctuation does.
- Uniqueness. This is the important one. See below.
- Not previously breached. Attackers do not guess — they replay username and password pairs stolen from other services.
Why reuse is the real risk
The attack is called credential stuffing. A shopping site is breached, its user list is published, and automated tools try those same combinations against banks, mail providers and portals like this one. Your password here may have been strong; if it was also your password on a forum breached in 2019, its strength is irrelevant.
One reused password can compromise every account it was used on. Nothing else here matters as much as fixing that.
Use a password manager
Unique long passwords for every account are impossible to remember, and you should not be trying. A manager generates them, stores them encrypted and fills them in; you memorise one strong passphrase for the manager itself. Four or five unrelated words work well.
A useful side effect: a password manager will not autofill on a lookalike domain, because it matches the exact address. It catches phishing sites that fool people.
Change it when there is a reason
Rotating on a schedule for its own sake reliably produces predictable variations. Change a password when it may have been exposed, when it was shared, or when someone with access has left.
Then add two-factor
A strong unique password protects against guessing and reuse. Two-factor authentication protects against the password being stolen anyway. Use both.
If you think someone else has your password
Change it from a device you trust, then revoke active sessions — changing a password does not always sign out sessions that are already open. Then check that no unfamiliar two-factor method or contact has been added. The article on responding to a suspected compromise sets out the full order, which matters.
