What Attackers Actually Do
When people picture a password being broken, they often imagine someone sitting at a keyboard guessing. In practice, it is mostly automated. Programs try very large numbers of guesses, starting with the most common passwords, words from a dictionary, and predictable patterns like a name followed by a year.
A second route needs no guessing at all. When a website suffers a data breach, lists of email addresses and passwords can end up in circulation. Attackers then try those same combinations on other sites. This is why a password’s strength is only part of the story. The other part is whether you have used it anywhere else.
What Makes a Password Hard to Guess
The goal is a password that automated guessing is unlikely to hit. The following qualities matter most.
Length. Each extra character multiplies the number of possibilities a guesser must work through. A long password is generally stronger than a short one with a few symbols added.
Unpredictability. Common words, names, pet names, birthdays, keyboard runs like a row of adjacent keys, and well-known substitutions (such as swapping an “a” for an “@”) are all in the lists attackers try first. Changing “Password” into a slightly decorated version does not help much.
Uniqueness. A password used for only one account cannot be used to open another.
Passphrases
A passphrase is a string of several unrelated words, for example four or more chosen at random, rather than a famous quote or a line from a song. Passphrases can be long and still easy to remember, and they are a good fit for the few passwords you must keep in your head, such as the one that unlocks your password manager or your computer. The words should be genuinely random, not a phrase that means something to you.
Why Reuse Is the Bigger Danger
Suppose you use the same password for a small online forum and for your email. The forum is run by a hobbyist and has weak protection. If it is breached, your email address and password are exposed, and an attacker can try them on your email, then use your email to reset passwords everywhere else. One weak link opens the whole chain.
For that reason, the single most valuable change many people can make is to stop reusing passwords, starting with the accounts that matter most. Email comes first, since it is the key to resetting other accounts. Banking, shopping, cloud storage and anything that holds personal documents follow.
Password Managers
Remembering dozens of long, unique passwords is not realistic, which is why many people use a password manager. This is a program that stores your passwords in an encrypted vault, protected by one strong passphrase, and fills them in for you. Typical benefits include:
- It can generate long random passwords so you do not have to invent them.
- It fills in passwords only on matching sites, which can help you notice a fake login page that does not match.
There are trade-offs. If you forget the master passphrase, recovery may be impossible by design, so make sure you know how it works and keep a safe record of it, such as written on paper stored securely at home. The vault itself should be backed up, which fits with the wider habits in backup basics. Choose a manager from a reputable maker, and avoid unknown tools offered through ads or pop-ups.
Browsers and operating systems also include built-in password saving, which is better than reusing passwords. Whatever you use, protect the device itself with a lock screen.
Add a Second Step Where You Can
Even a strong, unique password can be stolen through a convincing fake page. A second sign-in step adds another barrier. After you enter your password, the site asks for something else, such as a code from an app or a prompt on a device you hold. The details, including the risk of losing access, are covered in two-factor sign-in, but the idea in brief is that a stolen password alone is no longer enough.
Prioritize turning this on for email, financial accounts and the account that controls your password manager.
Recovery Options Matter
Accounts usually offer ways to get back in if you lose access: a recovery email, a phone number, backup codes or security questions.
- Keep recovery details up to date. An old email address you no longer control is a risk.
- Treat security questions with care. If answers like a mother’s maiden name or first school can be found online, consider treating the answer as a second password, entering a random string and recording it in your password manager.
- If an account offers one-time backup codes, store them somewhere safe and separate from the device you normally use.
Everyday Sign-In Habits
- Be careful where you sign in. Phishing pages copy real login screens. If a message prompts you to log in, go to the site yourself instead. The signs are described in phishing emails.
- Avoid signing in on shared computers when possible, and always log out if you must. Separate user accounts help families keep their sign-ins apart on one machine.
- Change a password after a breach notice or if you suspect it has been exposed, and also anywhere you reused it.
- Change passwords when there is a reason. Forced changes every few weeks often lead to weak, predictable variations, so change a strong, unique password mainly if it may have been exposed.
Where to Start
You do not need to fix everything in one afternoon. A reasonable sequence is:
- Choose a strong passphrase for your email and, if you have one, the manager.
- Set up a password manager and move your most important accounts into it.
- Replace reused passwords one at a time, beginning with the important ones.
- Turn on a second sign-in step for email and financial accounts.
- Check that recovery options are current.
No approach makes an account immune to every kind of attack, but these steps help a great deal.