Password Security 101: Creating & Managing Strong Passwords

Most accounts are not stolen by breaking advanced algorithms. They are stolen because the password was weak, or because one password guarded too many sites. This guide covers what makes a password strong, how to generate and remember one, and how websites store passwords.

Weak Passwords Are Still Everywhere

The annual "most common passwords" lists barely change. 123456, password, 12345678, qwerty and 111111 rank near the top year after year. Attackers hold public breach corpora with billions of email-and-password pairs. Cracking scripts try candidates in rough order of frequency, so a run against a login endpoint hits thousands of accounts within seconds.

The broader threat is credential stuffing. After site A leaks, attackers replay the same username-password pair against sites B, C and D with automated logins. Reuse on even two sites means one database breach unlocks all of them.

What Actually Makes a Password Strong

• Length beats cleverness. A 16-character random password is far harder to crack than a "complex" 8-character one. Raise length first, then add symbol variety.
• Mix character classes. Upper- and lowercase letters, digits and symbols widen the space an attacker must search.
• Uniqueness per site. Reuse is the single biggest risk factor.
• Avoid predictable material. Birthdays, phone numbers, pet names and keyboard walks such as 1qaz2wsx sit at the top of every dictionary attack.

A Little Entropy Goes a Long Way

Password strength can be measured as entropy, in bits. One character picked at random from the 95 printable ASCII characters contributes about 6.6 bits. Every extra random character multiplies the combinations by 95 and adds another 6.6 bits. Eight random characters give roughly 53 bits, twelve about 79, and sixteen exceed 105 bits. Each additional bit doubles the work of an exhaustive search, so a 16-character random password is beyond brute force.

The site side matters just as much. Slow hashes such as bcrypt or Argon2 make cracking orders of magnitude harder. Against fast hashes like MD5, modern GPUs try billions of guesses per second, and even a "tricky" short password falls.

Three Practical Strategies

1. Use a password manager. You memorize one long master password; the manager generates and autofills unique random passwords everywhere. The Random Password Generator on this site creates strong passwords locally in your browser, by length and character set. Nothing is sent to a server.
2. Try passphrases. Pick four or five words at random from a word list and join them. Each word contributes roughly 12.9 bits, so five words pass 64 bits. They stay far easier to memorize than gibberish of equal strength.
3. Turn on two-factor authentication. A second factor keeps the account alive even if the password leaks. Authenticator apps with one-time codes are preferable to SMS.

Why Sites Should Never Store Your Password

A responsible site does not know your password. At registration it stores only a fixed-length string produced by running the password through a hash function. At login it hashes what you typed and compares the results. Hashing is one-way: recovering the original from the hash is computationally infeasible.

Hashing alone is not enough; it needs a salt. A salt is a random value generated per user and combined with the password before hashing. Without salts, two users choosing the same password produce identical hashes. Precomputed "rainbow tables" can then reverse a whole database at once. Salting makes rainbow tables useless and forces attackers to work user by user. To see what these values look like, compare MD5 and SHA-256 output for the same text with the site's Hash Generator.

Two Myths and One Legit Encryption Case

Myth one: birthdays and anniversaries. They are short, structurally predictable and often reconstructible from a social profile. Their real entropy is tiny.

Myth two: one base password plus a site suffix. Appending "fb" or "tw" for each site looks unique but is a published rule in attackers' mangling dictionaries. One leak unravels everything.

Genuinely sensitive text such as recovery codes, seed phrases and keys should not sit in plaintext notes. Keep it in a password manager first. To move it across an untrusted device, encrypt it locally in your browser with the site's AES Encrypt/Decrypt tool. Send only the ciphertext through the chat app, and pass the key over a separate channel. The plaintext never touches a server.

Common mistakes and how to fix them

Breaches rarely come from ignorance of the rules. They come from plausible-sounding habits that feel like precautions. These are the most common ones.

• Insisting on changing passwords every 90 days. The mistake: forced rotation pushes people into predictable variants. Winter2023! becomes Winter2024!, and the trailing digit ticks up. Entropy never grows, while the pattern hands attackers a template. NIST's SP 800-63B no longer recommends routine expiry at all. The fix: keep passwords long, random, and unique. Change one immediately after a breach report or a suspicious-login alert, and check credentials against breach corpora regularly.
• Keeping passwords in a spreadsheet or phone screenshots. The mistake: spreadsheets are usually unencrypted. One leaked sync folder or stolen laptop gives up every account. Screenshots are sneakier: they auto-upload to photo backups and can surface in keyboard and editor caches. The fix: move everything into a password manager that encrypts and autofills. Then delete the old file and the screenshots, including the "recently deleted" albums.
• Hand-crafting "strong" passwords from pinyin names, birthdays, and exclamation marks. The mistake: patterns like a romanized name plus a year plus a trailing symbol sit at the top of attackers' rule dictionaries. They look complex but fall within minutes. The fix: stop composing by hand. Generate a 16+ character random string, or pick four or more random words and join them into a passphrase.
• Leaving routers, cameras, and NAS boxes on factory default passwords. The mistake: default credential lists are public, and scanners sweeping the internet try them first. A compromised device then becomes a launchpad into the rest of your network. The fix: change the defaults on day one, disable administration from the public internet, and keep firmware updated.
• Treating SMS codes as sufficient two-factor. The mistake: SIM-swap attacks let an attacker port your number to their SIM and receive your codes. Phishing kits relay the codes you type in real time. The fix: switch to authenticator-app one-time codes, use a hardware security key for critical accounts, and turn 2FA on for the recovery email too.
• Setting a weak master password and calling the manager "secure". The mistake: the manager locks every credential behind one door. An 8-character master password, or one on a sticky note by the monitor, turns all your accounts into a single flimsy lock. The fix: use a five-word passphrase as the master password, over 60 bits of entropy, memorable yet unguessable. Enable two-factor on the manager itself.