Most password advice makes passwords harder to remember, not harder to crack. This post covers what actually works: how passwords get broken, why random words beat symbols, and the habits that protect you when a site you use is hacked.
How passwords are cracked
Nobody sits and types guesses one by one. When a website is breached, attackers often walk away with its password database, or rather the hashes: one-way fingerprints computed from each password. They can then test guesses on their own hardware as fast as it allows, with no login limit to stop them.
They don’t start with random strings. First come real passwords from earlier leaks (123456, qwerty, password1), then the same lists with predictable changes: a capital first letter, @ instead of a, a year or ! at the end. Summer2024! looks complex, but it sits near the top of those lists.
The checker on my home page estimates exactly this attack: a stolen database, fast hashes and about ten billion guesses per second. It runs in your browser and sends nothing anywhere. Still, type something similar to your passwords, not a real one.
Length beats symbols
Every extra character multiplies the number of possible passwords. A random 8-character password that uses every symbol on the keyboard has about 6.6 quadrillion combinations. At ten billion guesses per second that is roughly a week of work, and far less with a few graphics cards.
Make it 12 random characters and the same attack needs more than a million years. Adding a symbol to a short password helps a little. Adding length helps enormously, and length is easy to remember when it is made of words.
A passphrase of random words
A passphrase is several unrelated words joined together, like violet-anchor-mango-thunder-quilt. Five words picked at random from a list of 7,776 (the classic Diceware method) give about as many combinations as a random 10-character password, and you can remember them as one silly picture.
The key word is random. A line from a song, a proverb, or your street plus your birth year are all in attackers’ lists. Let dice or a password generator choose the words, not your memory. Use five or six words for the accounts that matter most, your email and your password manager.
One account, one password
Reusing a password is the most common way ordinary people get hacked. When one site leaks, attackers feed its email and password pairs into scripts that try them on email, banking, social and shopping sites. This is called credential stuffing.
With a unique password for every account, one leak stays one leak. Nobody can remember a hundred unique passwords, and you don’t have to: a password manager does. Bitwarden (open source, with a free plan), 1Password, KeePassXC (works offline) or the manager built into your phone and browser will generate long random passwords and fill them in. You remember one strong passphrase.
A manager also guards against phishing: it won’t fill in your bank password on a look-alike site.
Two-factor and passkeys
Two-factor authentication asks for something beyond the password, so a stolen password alone won’t do. Prefer an authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, or the one in your password manager) to SMS codes, which scammers can intercept by talking a mobile operator into moving your number to a new SIM card.
Passkeys, now supported by Google, Apple, Microsoft and many others, are better still. A passkey lives on your device, unlocks with your fingerprint, face or PIN, and works only on the real website, so there is nothing to phish.
On Telegram, turn on Two-Step Verification in Settings → Privacy and Security. Then a stolen login code alone can’t take over your account.
Has your password leaked?
Have I Been Pwned (opens in a new tab) shows which known breaches include your email address. Its Pwned Passwords service checks a password without ever seeing it: your device hashes the password with SHA-1 and sends only the first five characters of the hash. The service returns every leaked hash that starts with them, and the comparison happens on your side. Password managers and browsers use the same trick for their leak warnings.
If a password shows up, change it everywhere you used it, starting with your email.
What the standards say now
NIST, the US standards body whose guidelines many companies follow, dropped several old rules in its current SP 800-63B guidance. Services should not force you to change passwords on a schedule, only after signs of compromise. They should not demand a mix of capitals, digits and symbols. Instead they should allow long passwords and pasting, block passwords found in breaches or common lists, and require at least 15 characters when the password is the only thing protecting an account.
If a site still insists on “one symbol and one digit”, a long passphrase with a symbol between the words and a digit at the end will satisfy it.
A short checklist
- A different password for every account, kept in a password manager.
- Five or six random words for your email and the manager itself.
- Two-factor wherever it is offered: an app or a passkey rather than SMS, where you can.
- Check your email on Have I Been Pwned and replace any leaked or reused password.
- Never type a real password into a site it doesn’t belong to, including strength checkers like mine.
