What a password is protecting
A password is a shared secret between you and a service. If you can supply it, the service assumes you are you. That makes it a single point of failure, so the way passwords are chosen and kept matters a lot.
How attackers get passwords
It helps to know the common routes, because they explain the advice.
- Guessing. Attackers try common choices first, such as simple words, names, keyboard patterns and short number sequences. Lists of the most popular passwords are widely known, and software can try huge numbers of guesses quickly when it is able to test them offline.
- Reuse after a breach. When a company’s user database leaks, criminals try the same email and password pairs on other services. This is often called credential stuffing. It works because many people reuse passwords.
- Phishing. A fake message or website tricks you into typing your password into the wrong place. No password is strong enough to survive being handed over.
- Malware. Software on an infected device can record what you type.
- Looking over a shoulder or finding a note. Low-tech, but it happens.
What makes a password weak or strong
Strength is largely about how hard a password is to guess, which depends on how unpredictable it is.
Weaker choices tend to be:
- Short.
- Built from a dictionary word, a name, a date of birth or a pet’s name, perhaps with an obvious change such as an “a” turned into “@”.
- Reused across accounts.
- Based on personal details that could be found on social media.
Stronger choices tend to be:
- Long. Length is usually the biggest factor, because every added character multiplies the number of possibilities.
- Unpredictable, such as randomly generated, rather than made up by a person following habits.
- Unique to each account.
A passphrase is one way to get length without losing memorability: several unrelated words strung together, for example four or more random words. The key is that the words are chosen randomly and not from a famous quote or a lyric. Many security guidance bodies have moved away from requiring frequent forced changes or complicated symbol rules, since these often lead people to choose predictable patterns. Rules differ by organization, so follow the requirements of a given site while keeping the underlying principles in mind.
How sites store passwords
A well-run service does not keep your password as plain text. Instead it stores a hash, which is the result of running the password through a one-way mathematical function. At login, it hashes what you type and compares the result. If the database leaks, attackers get the hashes and still have to guess passwords that produce them. Good systems also add a unique random value, called a salt, to each password before hashing, so identical passwords do not produce identical hashes, and they use deliberately slow functions to make mass guessing harder.
You cannot see how a given site does this. That is one reason unique passwords matter: if a careless site stores yours poorly, the damage stays limited to that one account. The broader concepts of scrambling data are explained in encryption basics.
The problem of too many passwords
A typical person may have dozens or even hundreds of accounts. Remembering a long, unique password for each is unrealistic. People respond by reusing a few passwords, writing them down, or making small variations. Reuse in particular is risky, as described above.
What a password manager does
A password manager is a program or service that stores your logins in an encrypted vault. You remember one strong master password, or use another way to unlock it, and the manager does the rest:
- Generates long random passwords for new accounts.
- Stores them securely.
- Fills them in automatically on the right sites.
- Often flags reused or weak passwords, and may alert you when a stored site has been in a known breach.
Because the manager fills in passwords only on the matching web address, it can also act as a mild defense against fake sites, since it may not offer your login on a lookalike page. That is a useful signal, but not a guarantee.
Managers come in several forms. Browsers and phones often have built-in ones. Dedicated apps may offer more features, such as sharing within a family. Some store the vault only on your device and others sync it through the provider’s servers. Typically the vault is encrypted with a key derived from your master password, so that even the provider cannot read it, but designs differ and you should read how the one you consider describes its approach.
Honest trade-offs
- A master password becomes critical. If you forget it, you may be locked out of the vault, and recovery options vary. If someone learns it, they may reach everything, so it should be long, unique and protected with an extra login step.
- A manager is a concentrated target. This is a real consideration, but security professionals generally regard a reputable manager with unique passwords as safer than reuse. Opinions can differ on details, and the right choice depends on your situation.
- Convenience features have limits. Autofill can occasionally misfire, and you need a plan for access if you lose your phone.
- Not everything fits. Some passwords, like your device passcode and your email account, are usually better memorized.
Adding a second layer
Even a strong password can be stolen. Turning on an extra verification step makes a stolen password far less useful by itself, which is the idea behind two-factor authentication. Email accounts deserve special care, since they are often used to reset other passwords.
Practical habits
- Use a different password for every account, starting with email, banking and work.
- Prefer long passphrases or generated passwords over short complicated ones.
- Consider a reputable password manager, and protect it with a strong master password.
- Turn on extra verification wherever it is offered.
- Be careful where you type passwords, and treat unexpected login requests with suspicion.
- If you hear that a service you use was breached, change your password there, and anywhere you reused it.
- Keep a safe recovery method for important accounts.
No system is perfect, but these habits remove the most common weaknesses.