How strong does my password need to be?

The only requirement is eight characters or more. Everywhere you set one — signing up, accepting an invite, resetting a forgotten password, or changing it from your profile — a bar under the box fills as you type and rates it Poor, Weak, Fair, Strong or Excellent, with one suggestion underneath.

It marks down what gets guessed first: common words and names, football clubs, keyboard runs like "qwerty" or "abc", a year on the end, and your own name or email address. Length counts for more than anything else — three or four unrelated words beat one clever word with symbols in it.

Worth knowing: The rating is advice, not a gate. A password the bar calls Poor is still accepted as long as it's eight characters, because what the account enforces and what the screen advises shouldn't be two different things.

The rating is worked out in your browser: nothing you type into a password box is sent anywhere to be scored. It also isn't checked against passwords exposed in other companies' breaches, so a password that scores Excellent here can still be one you've used elsewhere — if it is, turn on two-factor authentication as well.