User guidance Administrators should make sure that the users are aware of how to construct strong passwords. Use passwords with eight characters or more. Do not use words that are available in the dictionary. Do not use a name, or any variation of the account name or administrator identity. Do not use accessible information such as phone numbers, birthdays, license plates, or social security numbers. Use a mixture of uppercase and lowercase letters, as well as digits or punctuation. When choosing a new password, make sure it is unrelated to any previous password.