Password Security

Foundation · 12 min

Length beats complexity

For years the taught rule was "add capitals, digits and symbols"; the result was short passwords no human could remember and computers could easily try. What actually decides a password's resistance to cracking is length: each extra character multiplies the number of possibilities to try. An eight-character complex password can be run through far faster than you would think on modern hardware; a plain-looking phrase of four or five words, by contrast, blows the possibility space up astronomically. The practical conclusion: instead of short acrobatics like "P@ssw0rd!", use long phrases like "purple kettle sings at dawn" — both strong and memorable. The phrase must not be guessable, of course: your name, your birth year or a famous quote in sequence stays weak.

The cardinal sin: reuse

The single most dangerous password habit is using the same password across multiple accounts. Here is why: your password is usually stolen not from you but from a data breach at some service you signed up to. The leaked email-password pairs are collected, and attackers try them automatically on other popular services. If you use the same password for your email and your bank, a breach at some minor site you barely remember has dropped the key to your most valuable accounts onto the street. The rule is clear: every account gets a unique password — above all email, banking and your frequently used social accounts.

The password manager: the end of memorising

The rule "a unique long password for every account" cannot be sustained by memory — and it should not be. A password manager exists exactly for this: it keeps all your passwords in an encrypted vault, generates a random unique password for every new account, and fills in the right one when you visit a site. The only thing you memorise is the single master password that opens the vault — and that one should be a long phrase built with this lesson's method. The manager has a quiet extra benefit: autofill does not work on fake sites, because the address does not match the real one; that acts as a silent alarm against phishing. Browsers' built-in password saving offers a similar basic function; what matters is using a system and stepping out of the memorise-and-reuse loop.

Where to start

You may have hundreds of accounts; fixing them all in a day is neither necessary nor realistic. The order should be: first your email account — because every other account's "forgot my password" door opens onto it, and the whole account recovery chain runs through it. Then banking and payment accounts, then your frequently used social and shopping accounts. Give each a unique long password and save it in the manager. The remaining accounts get cleaned up over time, as you encounter them — fixing one at each login.