Why and when to change your password

Change your computer password if you think someone else knows it, if you have not changed it in over a year, or if you are setting up a device for the first time. You should also change it if you used the same password on a website that was breached — websites get hacked regularly, and attackers try those same passwords on computers and email accounts.

A strong password on your computer matters because it is the lock between someone at your keyboard and everything stored on your device: financial records, photos, work files, and the ability to reset passwords for your email and bank accounts. If someone gets in, they can lock you out of your own device or steal information without you knowing.

The steps differ slightly depending on whether you use Windows, Mac, or Linux, but the principle is the same: you prove you are the owner by entering your current password, then set a new one.

Key Takeaways

  • On Windows, go to Settings > Accounts > Sign-in options > Password, click Change, and follow the prompts with your current password and new password twice.
  • On Mac, go to System Settings > General > Login Items & Extensions, then click Password in the sidebar, and enter your current password before creating a new one.
  • A strong password is at least 12 characters long and includes uppercase letters, lowercase letters, numbers, and symbols — avoid birthdays, names, and dictionary words.
  • If you forget your new password when ready after changing it, you can reset it using a password reset disk (Windows) or recovery key (Mac) that you should create before you change your password.
  • If you forget your password and have no recovery method, you will need to reinstall your operating system, which erases everything on the device.

Changing your password on Windows

Open Settings by pressing the Windows key and typing "Settings", then click the Settings app. Go to Accounts in the left menu, then click Sign-in options. Scroll down to the Password section and click Change.

Windows will ask you to enter your current password to confirm you own the device. Type it in and click Next. Then enter your new password twice — once in the "New password" field and once in the "Confirm password" field. Windows will show you a strength meter; aim for a password it marks as "Strong" or "Very strong".

Click Next, then Finish. You will be asked to sign out and sign back in with your new password. Do this right away so you know the new password works before you close the window.

Changing your password on Mac

Click the Apple menu in the top left corner and select System Settings. Click General in the left sidebar, then scroll down and click Login Items & Extensions. In the left sidebar, you will see a Password option — click it.

Mac will ask you to enter your current password. Type it in and click the lock icon to unlock the password settings. Then click the Change Password button. Enter your current password again, then type your new password twice — once in the "New password" field and once in the "Verify" field.

Click Change Password. You will be signed out automatically. Sign back in with your new password to confirm it works.

Creating a password that is actually strong

A strong password is at least 12 characters long and mixes uppercase letters, lowercase letters, numbers, and symbols. An example might be "BlueMoon#2847Desk" — it has capital and lowercase letters, numbers, and a symbol, and it is 18 characters long.

Avoid passwords based on your life: no birthdays, names of family members, pet names, or the street you grew up on. Attackers run through these first because they are straightforward to guess or find on social media. Do not use dictionary words in order, like "correct-horse-battery-staple" — that pattern is well-known now.

Do not reuse a password you have used anywhere else. If a website is breached and your password is stolen, attackers will try that same password on your computer, email, and bank account. A unique password on your computer means a breach somewhere else cannot unlock your device.

What to do if you forget your new password right after changing it

Before you change your password, create a password reset disk (Windows) or recovery key (Mac). This is a backup way to get back into your device if you forget the new password.

On Windows: Open Settings > Accounts > Sign-in options > Password. Scroll down to the Reset your password section and click "Create a password reset disk". Windows will walk you through saving a file to a USB drive. Keep this USB drive in a safe place. If you forget your password later, plug in the USB drive at the login screen, click "Reset password", and follow the prompts.

On Mac: Before you change your password, go to System Settings > General > Login Items & Extensions, click Password, and look for a Recovery Key option. Write down this key or save it in a find location. If you forget your password, you can use this key to reset it at the login screen.

If you forget your password and have no recovery method

If you have no password reset disk, recovery key, or backup account on your device, you will need to reinstall your operating system. This erases everything on your computer — all files, programs, and settings — and returns it to a blank state.

To reinstall Windows, you will need another computer and a USB drive to create installation media. Go to microsoft.com/software-read/windows and follow the steps to read Windows and create a bootable USB. Then boot your locked computer from that USB and reinstall Windows from scratch.

To reinstall macOS, restart your Mac and hold Command + R to enter Recovery Mode. Click Reinstall macOS and follow the prompts. This also erases your drive, so use it only if you have no other way in.

This is why creating a recovery method before you change your password matters: it takes five minutes and saves you hours of reinstalling everything.

Changing your password on Linux

On Linux, open a terminal (usually by pressing Ctrl + Alt + T or searching for "Terminal" in your applications menu). Type the command passwd and press Enter. Linux will ask you to enter your current password, then prompt you to enter your new password twice.

Linux will tell you if your password is too weak — it usually requires at least 8 characters and some mix of letters and numbers. If it rejects your password, try a longer one with more variety in character types.

After you press Enter on your new password the second time, the change is complete. You do not need to sign out and back in; the new password takes effect when ready.

Frequently Asked Questions

Can I change my password if I forgot the old one?

No — the system requires you to enter your current password to prove you own the device before letting you set a new one. If you have forgotten it, you will need to use a password reset disk (Windows) or recovery key (Mac) that you created earlier, or reinstall your operating system.

How often should I change my computer password?

Change it at least once a year, or right away if you think someone else knows it or if you used the same password on a website that was breached. You do not need to change it every month — that can actually make passwords weaker because people choose simpler ones they can remember.

Is it safe to write down my password?

Writing it down is safer than reusing the same password everywhere or choosing a weak one you can remember. If you write it down, keep the paper in a locked drawer or safe, not on a sticky note on your monitor. A password manager (like Bitwarden or 1Password) is even better — it encrypts your passwords and you only need to remember one strong master password.

What if my computer is asking me to change my password but I do not want to?

If your workplace or school is forcing a password change, you have to do it — they control the device or network. If it is your own computer and you are seeing a prompt, it may be malware. Restart your computer in Safe Mode and run a full scan with Windows Defender (Windows) or Malwarebytes (Mac) before changing anything.

Can I use the same password on my computer and my email account?

No. If someone breaches your email provider and steals your password, they can then use it to log into your computer. Keep them different so a breach in one place does not unlock everything else.