Use a combination of letters, numbers, and symbols (minimum 8 characters). Avoid personal data like phone numbers or birthdays. Change passwords every 3 months and never reuse passwords on other sites.