"The password length should be at least 20 characters, but preferably 32," said lead researcher Jarno Niemela from the European cyber security provider F-Secure.
Criminals who attempt to crack the password databases use various forms of attacks based on words found in the dictionary.
This method usually works quite well because so many users pick terrible passwords.
"Humans in general are really bad password generators. No matter how unique you think your password is, its components are still likely to be in some dictionary, and a powerful cracking cluster will come up with the exactly right combination," Niemela said in a statement on Sunday.
But there are a few catches for this tip and two of them depend on the security practices of the service one is using.
First, the site or app has to accept long passwords and then the developers behind the software have to use any kind of "hashing" for the passwords they store.
Hashing employs an algorithm to hide passwords so they are not stored in clear text.
"So, you, as a customer, cannot affect what kind of password storage the service providers are using," he says, adding, "But you can still frustrate all but the most advanced attacker's efforts by using long enough random passwords."
So now you may be thinking: "Great! I have uncrackable passwords. They are also impossible to memorise."
Jarno recommended "some form of password storage" like F-Secure KEY which you can use on one device for free.
Many password lockers like KEY will help you generate extra long passwords, too.
"Also it might be a good idea to use a unique user name per service, and maybe unique email for critical services," Jarno said.
The unique user name will give you added privacy as you cannot be tracked easily across services.
