Password best practices
Length, uniqueness, password managers: the rules that actually protect your accounts, without losing your mind.
What actually matters
| Criterion | Why |
|---|---|
| Length (14+ characters) | The single biggest factor against brute-force |
| Uniqueness per site | A breach on one site doesn't compromise the others |
| No personal information | Avoids guessable attacks (birthdate, first name…) |
| Two-factor authentication (2FA) | Protects you even if the password leaks |
Complexity (forced uppercase, digits, symbols) matters less than length and uniqueness. A long, memorable passphrase (correct-horse-staple-battery) is often stronger than a short, complex password that's hard to remember — and so gets reused everywhere.
What a password manager actually does
A password manager generates and stores a unique, random password per site, encrypted behind a single master password you memorise. It's the recommended way to get both security and convenience without reusing passwords.
Signs a password should be changed
- Reused across several important accounts.
- Found in a known data breach (checkable via dedicated services).
- Shared in plain text over chat or email.
- Never changed since account creation, years ago, on a sensitive service.
2FA methods, from weakest to strongest
| Method | Security level |
|---|---|
| SMS | Decent, but vulnerable to SIM swapping |
| Authenticator app (TOTP) | Good security/convenience trade-off |
| Physical security key (FIDO2/U2F) | The most robust against phishing |
How long to "crack" a password?
| Length + composition | Estimated time (modern offline attack) |
|---|---|
| 8 characters, lowercase only | A few minutes |
| 8 characters, mixed (upper/lower/digits) | A few hours to a few days |
| 12 characters, mixed | Several centuries |
| 16+ characters or a passphrase | Considered impractical with current technology |
These estimates vary enormously with the attacker's computing power and assume a password not already in a known-breach dictionary — a "strong" but already-compromised password cracks instantly through a simple lookup instead.
Security questions: the forgotten weak link
Security questions ("mother's maiden name", "city of birth") are often easier to guess or find publicly than a password — answering with a random string stored in your password manager, instead of the real answer, reduces this risk.
Thanks for the feedback!