Back to Technology & Computing

Password Security: Creating and Managing Strong Passwords

7 min read

Password Security: Creating and Managing Strong Passwords

Every year, security researchers publish lists of the most commonly used passwords, and every year the results are alarming. Passwords like "123456," "password," and "qwerty" still top the charts. In a world where data breaches expose billions of credentials annually, understanding password security is not optional -- it is essential. This guide explains what makes passwords weak, how attackers crack them, and what you can do to protect your accounts.

What Makes a Password Weak?

Weak passwords share predictable characteristics that attackers exploit:

  • Short length -- Passwords under 8 characters can be brute-forced in seconds with modern hardware
  • Common words -- Dictionary words like "sunshine," "football," or "dragon" appear in every cracking wordlist
  • Personal information -- Names, birthdays, pet names, and addresses are easily found on social media
  • Simple patterns -- Sequences like "abc123," "111111," or keyboard walks like "qwertyuiop"
  • Password reuse -- Using the same password on multiple sites means one breach compromises all your accounts

Understanding Password Entropy

Password strength is measured in bits of entropy, a concept from information theory that quantifies how unpredictable a password is. The formula is:

Entropy = log2(Character Set Size ^ Password Length)

Two factors determine entropy:

  1. Character set size -- Using only lowercase letters gives you 26 possible characters per position. Adding uppercase doubles it to 52. Adding digits brings it to 62. Adding symbols pushes it to 90 or more.
  2. Password length -- Each additional character multiplies the total number of possible combinations by the character set size.

Here is how length and character set interact:

  • An 8-character lowercase password: 37.6 bits of entropy (crackable in minutes)
  • An 8-character mixed-case + digits + symbols password: 52.4 bits (crackable in hours to days)
  • A 16-character lowercase password: 75.2 bits (practically uncrackable by brute force)
  • A 20-character lowercase password: 94 bits (astronomically secure)

The critical insight is that length contributes more to security than complexity. A long passphrase of simple words is often stronger and easier to remember than a short string of random characters.

How Brute Force Attacks Work

In a brute force attack, an attacker systematically tries every possible combination of characters until finding the correct password. Modern GPUs can test billions of password hashes per second against common hashing algorithms like MD5 or SHA-1.

Attackers also use more efficient methods:

  • Dictionary attacks -- Testing common words and known passwords from previous breaches
  • Rule-based attacks -- Applying common modifications like appending numbers, capitalizing the first letter, or substituting "a" with "@"
  • Credential stuffing -- Using stolen username/password pairs from one breach to log into other services

This is why password reuse is so dangerous. If your email and banking site share the same password, a breach at a minor forum can compromise your bank account.

Modern Password Best Practices

Security recommendations have evolved significantly. Here are the current best practices endorsed by NIST and security professionals:

  1. Prioritize length over complexity. A passphrase like "correct horse battery staple" (four random words) has approximately 44 bits of entropy from dictionary words alone, and is far easier to remember than "X#9kL!2m". Using five or six words pushes entropy even higher.
  2. Use a unique password for every account. No exceptions. If you reuse passwords, a single breach cascades across your digital life.
  3. Avoid common substitutions. Replacing "e" with "3" or "a" with "@" does not meaningfully improve security. Attackers know these tricks.
  4. Do not change passwords on a fixed schedule unless you suspect a compromise. Forced rotation leads to weaker passwords as users make minimal, predictable changes.

Why You Need a Password Manager

Following the advice above means remembering dozens of unique, long passwords -- which is effectively impossible without help. Password managers solve this problem by:

  • Generating strong, random passwords for every account
  • Storing them in an encrypted vault protected by one master password
  • Auto-filling credentials so you never need to type or remember them
  • Alerting you when passwords are reused or appear in known breaches

Popular options include Bitwarden (open source), 1Password, and KeePassXC (offline). The one password you do need to memorize -- your master password -- should be a long, memorable passphrase.

Two-Factor Authentication

Even the strongest password can be compromised through phishing or a server-side breach. Two-factor authentication (2FA) adds a second layer of security by requiring something you have (a phone, hardware key, or authenticator app) in addition to something you know (your password).

The most secure forms of 2FA are:

  • Hardware security keys (YubiKey, Google Titan) -- Phishing-resistant
  • Authenticator apps (Authy, Google Authenticator) -- Time-based one-time codes
  • SMS codes -- Better than nothing, but vulnerable to SIM-swapping attacks

Enable 2FA on every account that supports it, starting with email, banking, and social media.

Have You Been Breached?

The website Have I Been Pwned (haveibeenpwned.com) lets you check whether your email address or password has appeared in known data breaches. If your credentials appear in a breach, change the affected passwords immediately and ensure you are not reusing them elsewhere.

Related Calculators