Everything you were taught about passwords — the symbol swaps, the forced weirdness — produced passwords that are hard for humans and easy for computers. Here’s the version that’s the opposite.
Length beats cleverness
Cracking software tries every “clever” trick first: P@ssw0rd, Tr0ub4dor, name+birth year. What it can’t shortcut is length. Each extra character multiplies the work exponentially — a 16-character simple passphrase outlasts an 8-character symbol soup by centuries.
The passphrase method
- Pick 4 unrelated words. Random, not a famous quote: mango-truck-silent-lamp.
- Add one number and one symbol somewhere unexpected. mango-truck7-silent-lamp!
- Make it yours with an image. Picture a mango driving a truck silently past a lamp — absurd images are what memory keeps.
Test the difference yourself: put your old-style password and a 4-word passphrase through our password strength checker — it runs entirely in your browser and shows the crack-time gap instantly.
The real killer: reuse
The strongest password in the world is worthless if you use it on ten sites — because when any one of them leaks (and they do), attackers try that email+password combo everywhere. One password, one site. No exceptions for “unimportant” accounts, because those become the doorway.
The two upgrades that beat any password
- A password manager. It generates and remembers a unique strong password per site; you remember one master passphrase. This solves reuse permanently.
- Two-factor authentication (2FA) on anything that matters — email first, since email resets everything else. With 2FA, even a stolen password isn’t enough.
Where passwords should never go
A strong password protects you only while it stays on the official site. Any app or website asking you to type another platform’s password into it is a trap, however friendly it looks — the password rule explains why, and our app safety checklist catches those apps before install.
How often should I change passwords?
Only when there’s a reason — a breach, a shared device, a suspicious login. Forced regular rotation just produces weaker patterns (Password1, Password2…). Unique + strong + 2FA beats frequent changes.
