Password Security Best Practices: Create and Manage Strong Passwords

Why Password Security Matters

Passwords are the first line of defense for your digital life. A compromised password can lead to:

• Identity theft: Criminals using your accounts to impersonate you
• Financial loss: Unauthorized access to banking and payment accounts
• Data breaches: Exposure of personal and professional information
• Account takeover: Loss of access to email, social media, and other services
• Lateral movement: Hackers using one compromised account to access others

What Makes a Password Strong

Key Factors

Password Strength Examples

Understanding Password Entropy

Entropy measures password randomness in bits. Higher entropy = more secure password.

How Entropy is Calculated

Entropy = Length × log₂(Character Pool Size)

Example: 12-character password with uppercase, lowercase, numbers, symbols
Pool size: 26 + 26 + 10 + 32 = 94 characters
Entropy: 12 × log₂(94) ≈ 12 × 6.55 ≈ 79 bits

Entropy Guidelines

*Assuming 1 billion guesses per second with offline attack

Use our Password Generator to create passwords with specific entropy levels.

Common Password Mistakes

1. Using Personal Information

Attackers often research targets on social media. Avoid:

• Birthdates, anniversaries
• Names of family members, pets
• Phone numbers, addresses
• Sports teams, favorite bands

2. Predictable Patterns

❌ password123
❌ qwerty
❌ 123456789
❌ Password1!
❌ Summer2024!
❌ [Company]123

3. Simple Substitutions

Attackers know these tricks:

• a → @, e → 3, i → 1, o → 0
• s → $, t → 7
• Adding 123 or ! at the end

4. Password Reuse

When one site is breached, attackers try those credentials everywhere. Use unique passwords for every account.

5. Short Passwords

Even complex 8-character passwords can be cracked in hours. Length matters more than complexity.

Creating Strong Passwords

Method 1: Random Password Generator

The most secure approach - generate truly random passwords:

Examples (from random generator):
Kj#9xM$pL2@nQ5wR
vB7&mT*2hN#4pQ9z
9$Lm#Kx2@nP5wR7q

Generate your own with our Password Generator.

Method 2: Passphrase

Combine random words for memorability:

correct-horse-battery-staple (famous XKCD example)
umbrella$piano$rocket$forest
MountainCoffee!Bicycle7Dance

Good passphrases use:

• 4+ truly random words (not quotes or lyrics)
• Separators between words
• Optional: numbers and symbols mixed in

Method 3: Modified Passphrase

Start with a phrase and transform it:

Original: "My cat Felix loves to sleep 14 hours daily"
Password: McFl2s14h!d

Original: "I moved to New York City in 2019 for work"
Password: Im2NYC!2019fw

Site-Specific Passwords

Some people use a base password with site-specific additions. This is better than reuse but not ideal:

Base: Kj#9xM$p
Gmail: Kj#9xM$p.gm
Amazon: Kj#9xM$p.az

Better: Use a password manager with unique random passwords

Using Password Managers

Why Use a Password Manager?

• Unique passwords: Easy to use different password for every site
• Long, random passwords: No need to remember complex strings
• Auto-fill: Reduces phishing risk (won't fill on fake sites)
• Secure storage: Encrypted vault protected by master password
• Cross-device sync: Access passwords on all your devices

Popular Password Managers

Master Password Best Practices

Your master password protects everything. Make it:

• Long (20+ characters recommended)
• Memorable to you (you can't recover it)
• Never used anywhere else
• Backed up securely (written down in safe place)

Two-Factor Authentication (2FA)

Passwords alone aren't enough. Add 2FA wherever possible.

Types of 2FA (Best to Worst)

1. Hardware keys (YubiKey, Google Titan): Most secure, phishing resistant
2. Authenticator apps (Google Authenticator, Authy): Very secure, time-based codes
3. Push notifications: Convenient but can be social-engineered
4. SMS codes: Better than nothing but vulnerable to SIM swapping

Priority Accounts for 2FA

Enable 2FA on these first:

• Email (especially recovery email)
• Password manager
• Financial accounts
• Social media (especially work-related)
• Cloud storage

Tools and Resources

Check If You've Been Breached

Visit Have I Been Pwned to check if your email or passwords have appeared in known data breaches.