Why length beats complexity
Password strength is measured in entropy — the number of guesses an attacker must try — and length grows it exponentially while complexity grows it only linearly. Each extra lowercase letter multiplies the search space by 26, so moving from 8 to 16 characters squares the brute-force effort. A 16-character lowercase password has 26^16 combinations versus roughly 94^8 for an 8-character symbol mix.
The longer but simpler password is roughly seven million times harder to brute-force, which is why modern guidance emphasises 12–16 character minimums over forced symbol soup. Pick length first, then add unpredictability to taste.
- Entropy grows with length fastest — 16 lowercase beats 8 mixed symbols
- Aim for 16+ characters on important accounts, 12+ everywhere else
- Longer passwords are also easier to type correctly on a phone
- Run every new password through a strength checker before committing to it
What Sunshine2024! teaches us
Consider Sunshine2024! — capital letter, dictionary word, digits, symbol. It ticks every old-school complexity checkbox, yet it is weak and must be retired, never reused or tweaked. Attackers run dictionary-plus-pattern rules that try capitalised words followed by a year and a trailing symbol first, so millions of variants like it fall within seconds.
The lesson is that predictability kills complexity: seasons, team names, birth years, and keyboard walks collapse the real search space no matter how many character classes they use. Abandon the single-word-plus-year formula entirely in favour of random generation or multi-word passphrases.
How to build a strong memorable password
The friendliest strong scheme is a four-to-five-word passphrase of random words with your own separator and a digit. Five random words from a 7,776-word Diceware list give roughly 64 bits of entropy, which resists offline cracking for years when paired with a slow password hash on the server side.
For email, banking, and cloud storage, skip memorability: generate a fully random 18–20 character string and store it in a manager. Memorise only your device code and your master passphrase — everything else should be random, unique, and forgotten on purpose.
- Five random words plus a separator beats one tricky word with a year
- Generate 18–20 random characters for email, bank, and cloud accounts
- Never reuse a memorable password across two sites
- Roll dice or use a generator for word picks — never choose words yourself
Password managers and unique passwords
Reusing one password means one breached forum hands attackers your email and bank logins, because bots replay leaked pairs across thousands of sites automatically. A manager breaks this chain by remembering a different random secret per site, autofilling it so you never type, and warning you when a saved site appears in a breach.
Setup takes twenty minutes: install it on phone and laptop, import browser-saved passwords, and rotate the important accounts first — email, money, cloud, and social. Enable biometric unlock and export an encrypted backup yearly.
Two-factor logins and hashing explained
Two-factor authentication means a stolen password alone is useless: login needs your secret plus a rotating code from an authenticator app or a tap on a hardware key. SMS codes are weaker because numbers can be SIM-swapped, and hardware keys resist phishing entirely. Turn 2FA on for email first — whoever controls your inbox resets everything else.
Responsible sites never store your password; they store a salted hash made by a slow function like bcrypt or Argon2. Paste any candidate into a hash generator to see the avalanche effect: one changed letter produces a completely different digest, forcing attackers to guess rather than reverse.
- Enable 2FA everywhere starting with email; prefer app or hardware keys
- Servers store salted slow hashes, never plain passwords
- Save 2FA recovery codes in your manager before you need them
- Prefer hardware security keys for email and financial accounts
Password mistakes that get accounts hacked
The deadliest mistake is reuse across email and other sites — breach compilations with billions of pairs fuel automated stuffing that hijacks thousands of inboxes daily. Close behind is storing secrets in notes apps or spreadsheets, where malware or sync steals them silently, and sharing credentials over chat, which creates a permanent searchable copy.
Then come the leftovers: rotating Password1 to Password2 each quarter, answering real recovery questions that social media reveals, and ignoring breach alerts for months. Fix all four this week with unique secrets, manager storage, and same-day response to warnings.
- Never reuse your email password anywhere — it guards every reset link
- Do not store secrets in notes, sheets, chats, or sticky notes
- Give fake, manager-stored answers to recovery questions
Password security questions answered
How often should I change passwords? Only with reason — a breach notice, a phishing scare, or a lost device — because forced quarterly changes produce weaker choices. Turn on breach monitoring, then rotate just the affected account plus anywhere it was reused.
Are passkeys better? For supported sites, yes: a device-bound key unlocked by fingerprint that cannot be phished or leaked from a server. Enable passkeys where offered while keeping your manager for the rest, and print your recovery kit before an emergency.
- Change on breach or suspicion, not on a calendar
- Adopt passkeys where offered; they cannot be phished or replayed
- Print your manager recovery kit and store it offline today
- Enable breach alerts in your manager and rotate affected accounts same-day