Password Security: Best Practices That Actually Work

Most password advice is a decade out of date. "Use a capital letter, a number and a symbol" produced a generation of passwords like Summer2024! — which satisfies every corporate policy and is cracked in under a second, because attackers built their dictionaries around exactly those rules.

Here is what the evidence actually supports, and how to apply it without making your life miserable.

Length beats complexity

Password strength is measured in entropy — the number of guesses an attacker must make. Entropy scales linearly with character-set size and exponentially with length. Length wins, and it is not close.

Compare two passwords:

• P@ssw0rd! — nine characters, hits every complexity rule, appears in every leaked-password list ever assembled. Cracked instantly.
• correct-horse-battery-staple — twenty-eight characters, all lowercase, four common English words. Astronomically harder to brute force.

Modern GPU rigs test tens of billions of hashes per second against fast hash functions. Against that, eight characters is not a password, it is a formality. Twelve characters is the floor. Sixteen is a sensible default. Twenty or more for anything that matters.

NIST's own digital identity guidelines dropped mandatory complexity rules and periodic rotation years ago, precisely because both push people toward predictable patterns.

Reuse is the actual threat

Here is the uncomfortable arithmetic: it does not matter how strong your password is if you used it in more than one place.

Breaches happen constantly, and many happen at companies that stored passwords badly. When a forum you signed up to in 2016 leaks, those credentials are packaged into lists and replayed automatically against banks, email providers, retailers and cloud platforms. This is credential stuffing, and it is the single most common way ordinary accounts get taken over. It requires no skill and no targeting.

One leaked reuse can cascade: forum password → email account → password resets on everything else. Your email is the master key to your entire digital life, and it deserves a unique password no other service has ever seen.

Every account gets its own password. No exceptions. Which brings us to the only realistic way to do that.

Use a password manager

You cannot remember eighty unique twenty-character strings. Nobody can. A password manager generates them, stores them encrypted behind one strong master password, fills them in automatically, and — underrated benefit — refuses to autofill on a phishing domain that merely looks like your bank.

Any reputable manager beats no manager. Choose one that uses zero-knowledge encryption, has been independently audited, and offers export so you are never locked in.

Then memorise exactly two things: your master password and your device unlock. Make the master password a long passphrase, write it on paper, and store that paper somewhere physically secure. Losing it locks you out permanently, which is the correct behaviour for a vault.

Generating passwords properly

Humans are terrible random number generators. We favour keyboard patterns, birth years, pet names, and predictable substitutions like a → @ and s → $ — all of which the cracking dictionaries already contain.

Use the Password Generator, which draws from your browser's cryptographic random source (crypto.getRandomValues) rather than the weak Math.random() many web tools still use. Sensible defaults:

• Length 16-20 for typical accounts, 24+ for email, banking, and cloud infrastructure.
• Include all character classes, unless the site forbids symbols. Some still do.
• Consider excluding ambiguous characters (l, 1, I, O, 0) if you may ever type the password manually.
• Generate a fresh one per account. Never derive Site1!, Site2! variants — the pattern is trivially inferred once one leaks.

The generator runs entirely in your browser. Nothing is transmitted, logged or stored, which is exactly the property a password tool needs.

Passphrases: when you must memorise

For the handful of passwords you type from memory — device login, password manager master key — use a passphrase of four to six random, unrelated words: velvet-anchor-monsoon-tripod.

The words must be chosen randomly, not by you. A phrase you invented follows the grammar and associations of your own mind, and those are far more predictable than they feel. Random words, roughly 45 characters of easy-to-type lowercase, resistant to brute force, and memorable after two days of use.

Turn on two-factor authentication

Even a perfect password can be phished. 2FA means a stolen password alone is not enough. In rough order of strength:

1. Hardware security keys (FIDO2/WebAuthn) — the gold standard. Cryptographically bound to the real domain, so phishing simply fails.
2. Passkeys — the same underlying technology, stored in your phone or password manager. No password at all, and adoption is now broad.
3. Authenticator apps (TOTP) — six-digit codes. Solid and universally supported. Save the backup codes.
4. SMS codes — better than nothing, but vulnerable to SIM swapping. Use only when nothing else is offered.

Enable it on email first, then financial accounts, then anything holding customer data.

Stop rotating passwords on a schedule

Forced ninety-day rotation is counterproductive and formal guidance now says so. It drives Winter2026! → Spring2026! and makes users resent security. Change a password when there is a reason: a suspected breach, a shared credential, a departing team member, or a device you no longer control.

Things that quietly undermine everything

• Storing passwords in a browser without a master password. Anyone with your unlocked laptop has all of them.
• Emailing or Slacking credentials. They live forever in searchable archives and backups.
• Security questions answered honestly. Your mother's maiden name is on a public genealogy site. Answer with random strings and store them in your manager.
• Public Wi-Fi without HTTPS awareness. Check the padlock before logging in anywhere.
• Ignoring breach notifications. Change the password immediately, and anywhere you reused it.

A ten-minute starting plan

1. Install a password manager.
2. Change your email password first, to a 20+ character generated string.
3. Enable 2FA on email.
4. Work through your accounts in order of damage-if-lost: banking, cloud storage, social, shopping.
5. Check your addresses against a breach-notification service and fix anything flagged.

You will not finish in one sitting, and that is fine. Every account you convert is one fewer domino.

Generate your first proper password with the Password Generator, and if you need to verify file integrity or store hashed values, the Hash Generator handles SHA-256 and friends locally too.