What makes a password hard to guess
Attackers rarely sit and type guesses by hand. They use software that tries enormous numbers of possibilities, starting with the most likely: common words, popular passwords, names, dates, keyboard patterns and the passwords that have appeared in earlier data breaches. A good password is one that does not appear on those lists and would take a very large number of attempts to find by chance.
Two qualities matter most. The first is length: each extra character multiplies the number of possibilities an attacker would need to try. The second is unpredictability: a long password made from a favorite phrase, a pet’s name or a keyboard pattern is easier to guess than its length suggests, because people choose such things in predictable ways.
Length usually beats complexity
For years, people were told to add capital letters, numbers and symbols. The result was passwords such as a familiar word with a capital first letter and “1!” at the end. Attackers know those habits, and software tries those variations early. Current guidance from security bodies generally favors longer passwords over forced complexity, and discourages making people change passwords on a fixed schedule unless there is a reason to think one has been exposed.
As a rough rule of thumb, aim for at least 12 to 16 characters for ordinary accounts, and more for the ones that matter most. Exact thresholds vary by source and by what the site allows, so treat this as a starting point rather than a precise standard.
Passphrases
A passphrase is several words strung together. Because it is long, it can be strong while remaining easy to remember and type. What makes one work is that the words are unrelated and chosen randomly, not a quote, a song lyric or a sentence about you.
A method often suggested is to pick words from a large list using dice or a random generator, rather than choosing words that come to mind, since human choices tend to be predictable. Four or more random words is a common recommendation, and adding more makes it stronger still. You can separate the words with a symbol or add a number if a site insists, but length is doing most of the work.
Passphrases suit the few secrets you must memorize, such as the unlock code for your computer, the master password of a vault, or the login to your main email account. For everything else, random generated passwords are generally better.
Never reuse passwords
Reuse is one of the most common causes of account takeover. When a small website is breached, attackers take the leaked email and password pairs and try them on banks, email services and shopping sites. If you used the same password, they get in without guessing anything. This is sometimes called credential stuffing.
The practical rule is one password per account. If that sounds impossible to remember, it is, which is exactly why most people use a password manager to generate and store them. Variations on a theme, such as the same base with the site name added, do not solve the problem, since an attacker who sees one can often guess the pattern.
Start with email. Your main email account can usually reset the passwords of your other accounts, so it deserves your longest, most unique password. Next come financial accounts, then work and cloud accounts, then social media.
Add a second step
Even a good password can be stolen by a fake login page, malware or a breach, so a second sign-in step is a valuable backup. Multi-factor authentication asks for something beyond the password, such as a code from an app, a prompt on a trusted device or a physical security key. The various authentication methods differ in strength: text-message codes are better than no second step but can be intercepted or redirected in some situations, while app-based codes and physical keys are generally harder to attack. Use the strongest option the service offers, and keep the recovery codes somewhere safe.
Handling passwords day to day
- Do not write them where others can see them. A note on the monitor is a classic mistake. A written record kept in a locked drawer can be reasonable for a master password or recovery codes, but not in plain view.
- Do not share them casually. Never send a password by email or chat. Many services offer ways to grant access without sharing the login.
- Never give a password to someone who asks for it. Real support staff, banks and employers do not usually need your password. Requests by phone or message are a typical form of social engineering, even when the caller sounds convincing and urgent.
- Check the address before you type. Fake pages are built to look identical to real ones. Typing the address yourself or using a saved bookmark is safer than following a link in a message.
- Be careful on shared devices. Avoid saving passwords in a browser on a computer other people use, and sign out when you finish.
- Do not trust security questions. Answers such as a mother’s maiden name or a first school can often be found or guessed. Where you must use them, consider treating the answers like extra passwords, random and stored securely.
If a password may be exposed
Signs that something is wrong include sign-in alerts you did not expect, password reset emails you did not request, and messages sent from your account that you did not write. If you notice them, change the password right away from a device you trust, make sure the second sign-in step is on, sign out other sessions and check whether recovery email addresses or phone numbers were changed. Then change the password anywhere else you used it. Our article on compromised accounts goes into the warning signs in more detail.
Some services and tools can tell you if your email address has appeared in a known breach. Such checks are useful, but they cover only breaches that are publicly known, so the absence of a warning is not proof that you are safe.
A short summary of good habits
- Make passwords long, preferring a passphrase for the few you memorize.
- Use a different password for every account, generated and stored by a tool.
- Turn on a second step for email, money and work accounts.
- Treat any request for your password as suspicious.
- Change a password promptly when you think it has been exposed, not on a calendar for its own sake.
These habits reduce risk but cannot remove it. A strong password will not help if you enter it on a fake page or your device is infected, which is why updates and caution with messages remain important alongside it.