Most hacked websites and mailboxes aren’t broken into with clever exploits. Someone simply logs in — with a password that was guessed, reused from another site, or handed over to a fake login page. A strong password won’t solve every security problem, but it closes the door that attackers try first. This guide explains what “strong” really means, how to manage dozens of passwords without going mad, and what to do after you change one so you don’t lock yourself out.
Need one right now? Our free secure password generator creates one in your browser in a single click — it’s never sent to us.
How Passwords Actually Get Cracked
It helps to know what you’re defending against. Attackers rarely sit and type guesses. They use software, and it works in a few predictable ways:
- Guessing at the login page. Bots try common passwords (
Password1,Summer2026!, your company name plus a year) against WordPress, webmail, cPanel and FTP logins, all day, every day. Our servers’ BitNinja protection blocks addresses that do this, which slows them down enormously — but a password that’s on every attacker’s list can still fall on the first few tries. - Cracking leaked databases. When a website is breached, its stored passwords are often stolen in bulk. Attackers then run billions of guesses per second against them on their own hardware, with no firewall in the way. Short or predictable passwords fall in minutes. Long random ones don’t.
- Credential stuffing. Once a password leaks, it’s tried automatically against email providers, banks, shops and hosting logins everywhere. If you used the same password on a forum that was breached years ago and on your business email, the attacker doesn’t need to crack anything.
- Phishing. A convincing “your mailbox is full” or “invoice attached” email links to a fake login page. No password is strong enough to survive being typed into the wrong website — which is why two-factor authentication matters (more below). See how our email filtering catches phishing.
What Makes a Password Strong
Strength comes down to one thing: how many guesses it would take. Three rules get you there.
1. Length matters most
Each extra character multiplies the number of possible passwords. A random 8-character password can be cracked from a leaked database surprisingly quickly with modern hardware; a random 16-character one would take longer than anyone is going to spend. Aim for at least 16 characters for everyday accounts and 20 or more for anything with admin access — cPanel, your EDZNET client area, email and WordPress administrator accounts.
2. It must be random
Humans are terrible at randomness. We capitalise the first letter, put the number and symbol at the end, and swap a for @ and o for 0. Cracking software knows all of these habits and tries them first, so P@ssw0rd2026! is far weaker than it looks. A password made by a proper random generator has no pattern to exploit.
3. It must be unique
This is the rule that matters most in practice. A perfect password used on two sites is only as safe as the weaker of those sites. Every account gets its own password — especially your email, because whoever controls your mailbox can reset the password for nearly everything else you use.
| Password | Why |
|---|---|
Edznet2026! | Weak — a word, a year and a symbol: the first pattern crackers try |
Tr0ub4dor&3 | Weak — looks complex, but it’s a dictionary word with predictable swaps |
correct horse battery staple | Reasonable only if the words were chosen at random — and not this famous example |
q7#Kx2vR!mW9pZ-eL4sN | Strong — 20 random characters, unique to one account |
What About Passphrases?
A passphrase is several random words strung together, like lantern-copper-violet-hammock-river. It’s easier to type and remember than random characters, which makes it a good choice for the few passwords you genuinely need to know by heart — such as the master password for your password manager or your computer login. The catch: the words must be picked randomly, not chosen by you. A line from a song or your children’s names is not a passphrase; it’s a guessable sentence.
Use a Password Manager
Nobody can remember 40 unique 20-character passwords, and you shouldn’t try. A password manager remembers them for you, fills them in automatically, and only asks you to remember one strong master password. Good options include Bitwarden, 1Password, and the managers built into Chrome, Edge, Safari (iCloud Keychain) and Firefox.
A password manager also protects you from phishing in a quiet way: it only fills your password in on the real website. If you click a link and it doesn’t offer to fill anything in, stop and check the address.
What not to do: keep passwords in a spreadsheet, a note on your phone, an email to yourself, or a sticky note on the monitor. And never send a password to anyone by email or in a support ticket — EDZNET support will never ask you for your password.
Turn On Two-Factor Authentication
Two-factor authentication (2FA) asks for a six-digit code from an app on your phone as well as your password. Even if a password is stolen or phished, the attacker can’t log in without your phone. It’s the single biggest upgrade you can make to any account.
- Your EDZNET account: log in to the client area and open Security Settings to enable it.
- cPanel: go to Security → Two-Factor Authentication and scan the QR code with an authenticator app.
- WordPress: add 2FA with a security plugin — our free EDZNET Security Guard plugin includes it for administrator accounts.
Use an authenticator app such as Google Authenticator, Microsoft Authenticator, Authy or your password manager’s built-in one, and save the backup codes somewhere safe in case you lose your phone.
Where to Change Your Passwords on EDZNET Hosting
- Client area (billing account): click your name in the top menu and choose Profile & Security, or go straight to Change Password.
- cPanel: from the client area, open your hosting service and use Change Password, or inside cPanel go to Preferences → Password & Security.
- Email accounts: in cPanel, open Email Accounts and click Manage beside the mailbox. Each mailbox should have its own password.
- WordPress: Users → Profile → Set New Password. Check for old administrator accounts you no longer use while you’re there, and delete them.
- FTP and databases: in cPanel under FTP Accounts and MySQL Databases. If you change a database password, update
wp-config.phptoo, or your site will stop loading.
Our password generator has a hosting-safe symbols option, switched on by default. It avoids characters such as quotes, backslashes and spaces that can break older email apps, FTP clients and configuration files like wp-config.php.
After You Change a Password: Update Every Device
This is the step people miss, and it causes more support tickets than anything else on this page. When you change an email password, every phone, tablet and computer that has the old one saved keeps trying it in the background. To our servers, that looks exactly like someone guessing passwords — so after a few failures, your connection gets blocked by the firewall, often taking everyone on the same office Wi-Fi with it.
So after a change, straight away:
- Update the password in the mail app on your phone, tablet, laptop and any other device still switched on — including that old phone in the drawer.
- Update any website contact forms, printers, scanners or other software that sends email using that mailbox.
- If you’re suddenly locked out, find your IP with What’s my IP and send it to support. Our guide Blocked from your website, email or cPanel? explains it step by step.
Signs a Password Has Been Compromised
- People tell you they’ve received strange emails from your address, or your sent folder contains messages you didn’t write.
- Bounce-backs arrive for emails you never sent.
- New administrator users appear in WordPress, or pages and links change on your site.
- You receive password reset or login alerts you didn’t ask for.
If you see any of these, change the password immediately from a device you trust, turn on 2FA, check for email forwarders or filters you didn’t create (a favourite trick for quietly copying your mail), and let our support team know — we can check the logs and help you clean up.
Frequently Asked Questions
How often should I change my passwords?
Current advice, including from the UK’s National Cyber Security Centre, is not to change strong passwords on a schedule — forced changes just lead to weaker, predictable ones. Change a password when there’s a reason: a breach, a suspicious login, a staff member leaving, or if you’ve ever reused it.
Is it safe to use an online password generator?
Only one that generates the password on your own device. Ours uses your browser’s built-in cryptographic random number generator and never sends the password anywhere — you can even disconnect from the internet after the page loads and it still works.
Should I let my browser save my passwords?
For most people, yes — modern browser password managers are secure, sync between your devices and only fill passwords on the right site. Protect them with a strong device password or PIN, and turn on 2FA for the browser account (Google, Microsoft or Apple) that syncs them.
What if I share a login with my team?
Give each person their own login wherever possible — their own mailbox, their own WordPress user, their own cPanel or FTP account. That way, when someone leaves you remove one account instead of changing a shared password everywhere. Where a login must be shared, use a password manager’s sharing feature, never email or chat.
How do I check if my password has been in a breach?
The free service Have I Been Pwned tells you whether your email address appears in known data breaches. Many password managers also warn you automatically about leaked or reused passwords.
