How to Create Passwords That Are Actually Secure
Meta description: Are you still using “Password123!” or your pet’s name for your passwords? Find out how to create truly secure passwords plus the habits needed to protect your accounts.
Let’s start with a little scary game. Is your password some variation of your pet’s name, a birthday, or the word “password” with an exclamation mark added on for good measure?
You’re not alone. Year after year security reports show that millions of people continue to use passwords that get hacked in a matter of hours if not minutes. The good news is that creating truly secure passwords isn’t nearly as difficult as we’re led to believe by Hollywood once we understand what those passwords should actually be.
Why Weak Passwords Are So Dangerous
Hackers aren’t going to methodically guess each and every potential password combination like the movies would have you believe. Instead, hackers will use specially built tools that can try billions of different combinations until they find the right one and have already been programmed with lists of commonly used passwords and patterns. While “Summer2024!” sounds pretty secure at first glance, a closer inspection shows that it follows a very common pattern that tools used to hack passwords are primed to recognize instantly.
The other danger with weak passwords is the habit of reusing the same password (or slight variations of it) across multiple accounts. If one of those accounts is compromised (and eventually all accounts are compromised at some point), the hacker will use that same password to gain entry to your other accounts as well.
What Makes A Good Password
1. Good passwords prioritize length over complexity
A long password is significantly more secure than a short, complex password. Security experts are actually advocating for length to be prioritized over special characters and other “complex” elements. A 16 character password that’s just letters will be significantly more secure than an 8 character password with special characters.
2. Avoid common patterns.
This means avoiding common substitutions (P@ssw0rd), sequential letters or numbers (123456 or abcdef), easily identifiable patterns (using a qwerty keyboard pattern or other such easily identified pattern), or any personal information (names, birthdays, pet names, etc).
3. Don’t reuse old passwords
This seems pretty self-explanatory but it’s worth noting. Even if you have a great password, if you’re reusing the same password across multiple sites, an exploit of one site compromises all of them.
4. Consider using passphrases instead
A passphrase isn’t a single word, but a series of random, unrelated words. Passphrases are much easier to remember than a random jumble of letters, numbers, and special characters, and can still be incredibly secure if you pick a long series of unrelated words (something like “4 random unrelated words”). Make sure to pick a set of completely random, unrelated words that isn’t something you might actually say or that could be identified as something you use.
The Real Solution: Use a Password Manager
Let’s be real here. Most of us can’t remember multiple strong, unique passwords. In fact, the whole reason we started reusing passwords in the first place was because we couldn’t remember a dozen different ones. A password manager solves all of these problems and more.
Using a password manager means you’ll always have strong, unique passwords for all of your accounts without having to remember what they are thanks to your phone or computer only needing to remember one password for the password manager itself.
A password manager can also alert you if any of your saved passwords are known to be compromised, or if any of your accounts have been breached (not hacked directly, but had their databases stolen and exposed online).
Many password managers offer free versions that are perfect for casual use.
Setting Up Your Master Password
Since the whole point of a password manager is to have a single, long-lasting password, it’s crucially important that you make it a truly strong password itself. As mentioned above, it’s a good idea to use a passphrase (4 or more unrelated words) for the master password, but there are a few additional considerations.
It’s important to note that you should never reuse your master password elsewhere. If your master password is compromised, it’s a lot like having all your eggs in one basket.
Consider writing down your master password somewhere (not digitally) and keeping it in a secure location as a backup
Many password managers offer two-step verification for the master password, so take advantage of that if you can.
Additional Security Tips
Enabling two-step verification on accounts that offer it will give you an additional layer of security even if someone does guess or steal your password.
Check to see if your email has been part of a data breach and if it has, change your password as soon as possible. If you’re not sure how to do this, many password managers can actually help with it.
Don’t fall for phishing scams that try to get you to type your password into a fake login screen. These scams are designed to steal your password and can be incredibly convincing.
It’s a good idea to periodically change any passwords that you think might have been compromised or if you notice suspicious activity on any of your accounts. Don’t wait until you know for sure that something has happened.
Addressing Common Misconceptions
Changing your password every month keeps your accounts secure.
Actually, frequent password changes often lead to weaker, easier to guess passwords (like adding a number to the end or changing a letter). It’s much better to have a single strong password that you change only when necessary.
Adding a “!” or “1” to the end of a weak password makes it secure.
Nope. Password cracking software often includes specific rules for identifying variations of common passwords so something like “Password1!” will still be cracked much faster than a truly random password with no special characters.
My accounts don’t have anything worth stealing.
Actually, any account can be used to reset other accounts. Even if your account doesn’t have anything of value on it, it can still be used to access other accounts (especially if you’re using the same password) or impersonate you to access other resources (credit cards, etc).
A Simple Summary
Pick the most important accounts (email, banking, and anything that involves payment information) and start there. Install a good password manager and let it take over all of your passwords. After that, change the weakest, most reused passwords first, then enable two-step security for the most important accounts. Check for breaches regularly (your password manager may do this for you) and change compromised passwords promptly.
Final Thoughts
Creating a good password isn’t about memorizing a complex string of characters. It’s about length, unique passwords, and letting a computer (your password manager) do what it’s good at. Taking a few minutes to secure your accounts can save you a world of headaches down the road.
Have you ever had an account compromised by a weak password or reused password? Share your story (and what changes you made after the fact) in the comments below!
