Every school sends home a flyer at some point about creating strong passwords. Use uppercase letters, add a number, do not use your pet's name. My son read it, nodded, and went back to using the same six-character password he had used since he was eight. The flyer did not work because it was abstract. He had no reason to care until something went wrong.
The moment that changed things
A classmate of his had their gaming account stolen. Someone had guessed the password because it was the character's name from a popular game followed by the number 1. My son knew this kid. He saw how upset he was. That single real story did more than any handout ever could. I used that moment to sit down with him and actually look at his own passwords together.
What we did instead of another lecture
We used a free password manager called Bitwarden to generate and store passwords for his accounts. He picked a strong passphrase he could remember for the manager itself, something like four random words strung together. Within a week, every account he used had a unique, long password he did not have to memorize.
The friction was lower than I expected. He liked that he did not have to remember anything. The habit formed because it made his life easier, not because I told him it was important.
Six months later
He now suggests the password manager to his friends. He noticed one friend reusing passwords and explained why that is a problem. That conversation happened without me in the room, which told me the habit had actually landed.