Dan came up with “Dan2004!”: upper and lower case, digits and a symbol. Why is it weak?

Bots try names and birth years first, and it’s only 8 long. “Letter+digit+symbol” rules create an illusion of strength. The predictable “name+year+!” pattern is in every cracking dictionary.

Have I Been Pwned shows Dan’s email in an old forum’s breach. What comes first?

Change that password everywhere it’s reused, starting with email and the exchange. The danger isn’t the forum but its password: bots try it everywhere else. Change it first where the money and password resets live.

Which password is strongest?

Five random words joined by hyphens, picked by a generator. Random words are long and unpredictable. A generator doesn’t know your favourite songs, so bots can’t guess either.

Passwords nobody can guess

Lesson 3 of 16 in the course “Cybersecurity from Scratch”. Free, with animations and a quiz.

Why “one for everything” is the biggest hole

Websites get hacked all the time, and databases of emails and passwords end up public. Bots take those pairs and try them on email, exchanges, banks and social networks. This is called credential stuffing. If Dan uses one password on nine sites, a leak from the weakest of them is enough, and all nine open. Nobody “hacked” anything: Dan himself handed out one key to every door.

Length wins

Compare how many combinations would have to be tried. 8 lowercase letters is about 200 billion; a graphics card gets through that fast. Eight mixed characters is 6·10¹⁵, but “Dan2004!” isn’t random: bots try names, dates and swaps like @ for a first. Six random words from a 7,776-word list give 2·10²³ combinations. A phrase like that is easy to remember and impossible to guess.

A phrase of random words

A good password isn’t “Q7#k!” that you’ll forget in a week, but a few random words: “cactus-lift-ginger-umbrella-friday”. The key word here is random. A song lyric or “iloveyoumycat” won’t do; bots try those too. Pick the words with dice or a generator, not your head. And every site needs its own password.

Check yourself in breaches

The Have I Been Pwned service collects databases from known breaches. You enter your email and see which hacks it showed up in. If a site on the list knew your password, treat that password as public: change it everywhere it’s reused. The site’s password check is built so the password itself never leaves your device: only the first characters of its hash are sent. A hash is a one-way “fingerprint” of the password.

What NIST says

NIST is the US standards institute; companies worldwide follow its password guidance. The key points of the current version: length beats “complexity”, and if a password is the only protection it should be at least 15 characters. Sites should check passwords against breach lists. Scheduled password changes aren’t needed, only when there are signs of a leak. And for you the main rule is simpler: a unique password for every site. In the trainer, see how long your idea would hold.

Check yourself

Dan came up with “Dan2004!”: upper and lower case, digits and a symbol. Why is it weak?
Correct answer: Bots try names and birth years first, and it’s only 8 long. “Letter+digit+symbol” rules create an illusion of strength. The predictable “name+year+!” pattern is in every cracking dictionary.
Have I Been Pwned shows Dan’s email in an old forum’s breach. What comes first?
Correct answer: Change that password everywhere it’s reused, starting with email and the exchange. The danger isn’t the forum but its password: bots try it everywhere else. Change it first where the money and password resets live.
Which password is strongest?
Correct answer: Five random words joined by hyphens, picked by a generator. Random words are long and unpredictable. A generator doesn’t know your favourite songs, so bots can’t guess either.

← Who hunts you and why A password manager: remember just one →