ES EN

PasswordSecure.org

How to create a strong password

Three rules that matter, and a few classic tips you can throw away.

Published Who we are

Almost everything we were taught about strong passwords was half wrong. Mixing capitals, numbers and symbols achieves very little if the result is still London2024!. What actually matters is a single idea: a password is strong when nobody can guess it or compute it, and that comes down to three things, not seven rules.

The three rules that matter

1. Long

Every character you add multiplies the work for anyone trying every combination. Going from 8 to 12 characters does not make a password 50 % harder: it makes it millions of times harder. Below 12 there is nothing else worth discussing; 16 is a good target for anything that matters. You can see the exact difference in the cracking-time table.

2. Unique

This is the rule most people break and the one that does the most damage. If you reuse the same password, the security of every account you own is the security of the worst-protected site you ever signed up to. When that site is breached, attackers try the same email-and-password pair on your bank, your email and your social accounts. It is automated, it is cheap, and it works far more often than it should.

3. Random

Here is the part almost nobody sees. A password is not strong because it looks complicated; it is strong because it was chosen at random. P@ssw0rd! has capitals, numbers and symbols, and it sits near the top of every attack dictionary. Cracking tools know every classic substitution: a for @, o for 0, i for 1. They are not an obstacle, they are a pattern.

What does not work (even though it looks like it does)

  • Adding 123 or ! at the end. It is the first thing cracking tools try, precisely because it is the first thing all of us do.
  • Using your own details. Your dog's name, your birth year or your team are on your social media. A targeted attack starts exactly there.
  • Drawing patterns on the keyboard. qwerty, 1qaz2wsx and zxcvbnm look random and are all on the lists.
  • Changing it every three months. This policy, mandatory for years at many companies, makes things worse: people end up rotating Summer1, Summer2, Summer3. NIST itself stopped recommending it.

Two methods that do work

For the ones you never need to recall: generate them at random

That is the vast majority. For any account you open in a browser, the ideal password is a long random string you will never memorise because you do not need to: the manager keeps it. Generate a random password of 16 characters or more and forget about it.

For the two or three you do: a passphrase

There are a handful of passwords you have to be able to type from memory — the one for your manager and the one for your main email, above all. There, a sequence of random words beats any jumble of symbols: stove-cactus-vinyl-rowing is easier to remember than K7#mQ2!v and vastly harder to break, because it is longer. The catch is that the words must be picked by dice or software, not by you: a phrase that makes sense is predictable again. Our passphrase generator does exactly that.

How many you actually have to remember

This is the part that surprises anyone who has never used a manager: the answer is two or three. Everything else lives inside the manager, protected by those. It stops being a memory problem and becomes the problem of protecting two keys well, which is far more manageable.

  1. Your password manager's. Long, unique, memorised, written down nowhere else.
  2. Your main email's. Whoever controls your email can reset almost any other account through "forgot my password".
  3. Your device's. Without it, everything above rests on a computer anyone can open.

When you should change one

Only when there is a reason, never by the calendar:

  • When it appears in a breach. That calls for acting fast and in order: we walk through it in what to do if your password was leaked.
  • When you have typed it on a computer that is not yours, or shared it with someone.
  • When you know it is weak or reused. In that case the moment is now, not next month.

And one more layer

A perfect password is still a single obstacle. Two-factor authentication adds the second one, and it is what turns a breach into a scare rather than a problem. If you want somewhere to start, check the passwords you already use in the password checker: it runs in your browser and never sends your password anywhere.

Sources