For all the talk of zero-days and fancy exploits, the way most accounts get broken into is boring: a weak, reused, or guessable password. It's the front door, and a lot of people leave it unlocked. So let me make the case for taking passwords seriously — and show you what actually makes one strong, because most of the old advice is wrong.
Why weak passwords fall
In my post on brute-forcing WPA2 passwords, I showed how a predictable 8-digit number can be cracked in seconds once you know its shape. That's not a WiFi problem — it's a password problem. The same idea applies to your email, your bank, your everything. Attackers don't sit there typing guesses by hand; they run software that tries millions of candidates against a stolen hash, or against a login form. There are three ways your password ends up in their hands:
- Brute force / dictionary attacks — software grinds through common words, leaked passwords, and patterns. Short or common passwords don't survive this. (And as I showed with crunch patterns, the more predictable the pattern, the faster it falls.)
- Credential stuffing — when one site gets breached, attackers take those email/password pairs and try them everywhere else. If you reused that password, one leak unlocks all your accounts.
- Data breaches — companies get hacked constantly, and their password databases leak. If yours is in there, it's already public.
Length beats complexity
Here's the part most people get backwards. For decades we were told a "strong" password meant P@ssw0rd! — uppercase, a number, a symbol. That advice is outdated, and the people who literally wrote the rules now say so.
The current NIST guidelines (SP 800-63B) flipped the script. What they recommend today:
- Length over complexity. A long password is exponentially harder to crack than a short "complex" one. Every extra character multiplies the number of guesses an attacker has to make. Aim for length first.
- No forced complexity rules. Mandatory "one uppercase, one symbol" requirements just push people toward predictable patterns (
Password1!) — they don't help. - No mandatory periodic changes. Forcing a reset every 90 days makes people pick weaker, incremental passwords (
Summer2025, thenSummer2026). Only change a password when you suspect it's compromised. - Screen against breached passwords. A password that's already appeared in a leak is worthless, no matter how complex it looks.
The intuition: a random 8-character password might have, say, a few trillion combinations. Add just a few more characters and you're into numbers with more zeros than a brute-force rig can chew through in any reasonable time. Length is the cheapest security you can buy.
What a strong password actually looks like
So here's the practical version — what I'd tell a friend:
- Go long. Use a passphrase. Four or five random, unrelated words is both strong and memorable — something like
copper-violin-midnight-anchor. It's far harder to crack thanTr0ub4dor!and far easier to remember. - Make every password unique. This is the single most important habit. Reuse is what turns one breach into ten compromised accounts. A unique password per site means a leak stays contained.
- Avoid the obvious. No names, birthdays, pet names,
123456, keyboard walks (qwerty), or "clever" substitutions like@fora— attackers' tools know every one of those tricks. - Use a password manager — or a system. A manager generates and stores a different strong password for every site so you only remember one master password. (More on the or a system part in a second.)
- Turn on multi-factor authentication (MFA). Even a perfect password can leak. A second factor — an app code or a hardware key — means a stolen password alone isn't enough.
- Check if you've already been breached. Have I Been Pwned tells you for free if your email or passwords have shown up in known leaks. If they have, change them.
Do these and you've shut the front door that the overwhelming majority of attacks walk through.
Coming next: passwords you carry in your head
A password manager is great — but some people don't want to depend on an app, a vault file, or a cloud sync. So in my next article I'll show you something different: how to generate a unique, strong password for every site using nothing but your own brain — a single phrase you memorize and a small personal algorithm you run in your head. No vault to leak, no file to lose, nothing stored anywhere. You "encrypt" the site's name through your own mental cipher and out comes a different strong password every time.
It's a fun bit of do-it-yourself cryptography, and once you learn the trick you'll never reuse a password again.
To be continued…
If you found this useful, subscribe to our RSS Feed and YouTube Channel. More security writeups are on the way.
References
- NIST — SP 800-63B, Digital Identity Guidelines: Authentication
- Have I Been Pwned — check if your accounts are in a known breach