The Strongest Passwords and the Best Way to Create (and Remember) Them

Some
of
the
strongest
passwords
you
can
use
are
the
ones
you
don’t
have
to
remember. 

Strange
as
that
may
sound,
it’s
true,
if
you
use
a
password
manager.
A
password
manager
creates
and
securely
stores
strong,
unique
passwords
for
each
of
your
accounts—and
does
all
the
remembering
for
you. 

And
remembering
is
the
root
of
the
problem
when
it
comes
to
insecure
passwords. 

Consider
how
many
passwords
you
have
across
all
your
accounts.
Then
consider
the
old
passwords
for
accounts
and
online
forums
you
no
longer
use,
along
with
all
the
times
you
created
a
password
for
an
online
store
that
you
only
shopped
at
once
or
twice.
All
those
passwords,
it’s
too
much
to
keep
track
of,
let
alone
manage.
And
that
leads
to
insecure
passwords.
Simple
passwords.
Or
passwords
that
get
used
again
and
again
across
several
accounts. 

Hackers
count
on
that.
They
love
it
when
people
use
simple
passwords,
reuse
passwords,
grab
passwords
out
of
the
dictionary,
or
base
their
passwords
on
their
pet
names
that
a
hacker
can
easily
glean
from
a
victim’s
social
media
posts.
They
also
love
“brute
force”
tools
that
help
them
break
into
accounts
by
quickly
feeding
account
logins
with
thousands
of
potential
passwords
in
minutes.  

So
when
you
make
your
life
easier
with
simple
or
reused
passwords,
you
make
life
easier
for
hackers
too. 

That’s
where
a
password
manager
comes
in.
It
makes
life
easy
for
you
to
stay
secure
while
still
making
it
tough
on
hackers—particularly
tough
with
strong,
unique
passwords
for
each
of
your
accounts
that
can
you
update
on
a
regular
basis,
which
offers
some
of
the
strongest
protection
you
have
against
hackers
hijacking
your
accounts. 

The
difference
between
a
good
and
bad
password

 

First
up,
let’s
look
at
password
practices
in
general
while
keeping
a
few
things
in
mind.
Hackers
will
look
for
the
quickest
payday.
In
some
cases
they’ll
work
with
a
long
list
of
accounts
that
they’re
trying
to
break
into.
If
a
password
on
that
list
proves
difficult
to
crack
they’ll
move
on
to
the
next
in
the
hope
that
it’ll
have
a
poor
password
that
they
can
easily
crack.
It’s
a
sort
of
hacker
economics.
There’s
often
little
incentive
for
them
to
spend
extra
time
on
a
strong
password
when
there
are
plenty
of
weak
ones
in
the
mix. 

So
what
do
poor
passwords
look
like?
Here
are
a
few
examples: 

• 
  
  Obvious
  passwords: Password-cracking
  programs
  start
  by
  entering
  a
  list
  of
  common
  (and
  arguably
  lazy)
  passwords.
  These
  may
  include
  the
  simple
  “password”
  or
  “1234567”.
  Others
  include
  common
  keyboard
  paths
  like
  “qwerty.”
  Even
  longer
  keyboard
  paths
  like
  “qwertyuiop”
  are
  well
  known
  to
  hackers
  and
  their
  tools
  as
  well. 
• 
  
  Repeated
  passwords: You
  may
  think
  you
  have
  such
  an
  unbreakable
  password
  that
  you
  want
  to
  use
  it
  for
  all
  your
  accounts.
  However,
  this
  means
  that
  if
  hackers
  compromise
  one
  of
  your
  accounts,
  all
  your
  other
  accounts
  are
  vulnerable.
  This
  is
  a
  favorite
  tactic
  of
  hackers.
  They’ll
  target
  less
  secure
  accounts
  and
  services
  and
  then
  attempt
  to
  re-use
  those
  credentials
  on
  more
  secure
  services
  like
  online
  bank
  and
  credit
  card
  companies.  
• 
  
  Personal
  information
  passwords: Passwords
  that
  include
  your
  birthday,
  dog’s
  name,
  or
  nickname
  leave
  you
  open
  to
  attack.
  While
  they’re
  easy
  for
  you
  to
  remember,
  they’re
  also
  easy
  for
  a
  hacker
  to
  discover—such
  as
  with
  a
  quick
  trip
  to
  your
  social
  media
  profile,
  particularly
  if
  it
  is
  not
  set
  to
  private. 

On
the
flip
side,
here’s
what
a
strong
password
looks
like: 

• 
  
  Long: Without
  getting
  into
  the
  math
  of
  it,
  a
  longer
  password
  is
  potentially
  a
  stronger
  password.
  When
  you
  select
  from
  the
  entire
  available
  keyboard
  of
  numbers,
  letters,
  and
  symbols,
  a
  password
  that
  is
  12
  characters
  long
  is
  far,
  far
  more
  difficult
  to
  crack
  than
  one
  with
  only
  five
  or
  even
  seven
  characters.
  And
  while
  no
  password
  is
  entirely
  uncrackable,
  taking
  that
  number
  up
  to
  16
  characters
  pushes
  your
  password
  into
  a
  highly
  secure
  category
  provided
  it
  doesn’t
  rely
  on
  common
  words
  or
  phrases. 
• 
  
  Complex: To
  increase
  the
  security
  of
  your
  password,
  it
  should
  have
  a
  combination
  of
  uppercase
  letters,
  lowercase
  letters,
  symbols,
  and
  numbers.
  Hacking
  algorithms
  look
  for
  word
  and
  number
  patterns.
  By
  mixing
  the
  types
  of
  characters,
  you
  will
  break
  the
  pattern
  and
  keep
  your
  accounts
  safe. 
• 
  
  Unique: 
  Every
  one
  of
  your
  accounts
  should
  have
  its
  own
  password.
  This
  is
  particularly
  true
  for
  sensitive
  accounts
  such
  as
  your
  financial
  institutions,
  social
  media
  accounts,
  and
  any
  work-related
  accounts. 
• 
  
  Updated:
  
  While
  you
  may
  have
  an
  undeniably
  strong
  password
  in
  place,
  it’s
  no
  longer
  secure
  if
  it
  gets
  stolen,
  such
  as
  in
  a
  data
  breach.
  In
  this
  case,
  updating
  your
  passwords
  every
  several
  months
  provides
  extra
  protection.
  This
  way,
  if
  a
  hacker
  steals
  one
  of
  your
  passwords
  in
  a
  breach,
  it
  may
  be
  out
  of
  date
  by
  the
  time
  they
  try
  to
  use
  it
  because
  you
  updated
  it. 
• 
  
  Backed
  by
  Multi-Factor
  Authentication
  (MFA):
  
  MFA
  offers
  another
  layer
  of
  protection
  by
  adding
  another
  factor
  into
  the
  login
  process,
  such
  as
  something
  you
  own
  like
  your
  phone.
  MFA
  has
  become
  a
  staple
  in
  many
  login
  processes
  for
  banks,
  payment
  apps,
  and
  even
  video
  game
  accounts
  when
  they
  send
  you
  a
  text
  or
  make
  a
  call
  to
  your
  phone
  with
  a
  security
  code
  that’s
  needed
  to
  complete
  the
  login
  process.
  So
  while
  a
  hacker
  may
  have
  your
  password,
  they’d
  still
  be
  locked
  out
  of
  your
  account
  because
  they
  don’t
  that
  security
  code
  because
  it’s
  on
  your
  phone.  

Creating
strong
passwords
on
your
own 

Long,
complex,
unique,
and
updated,
all
described
as
above—how
do
you
manage
all
that
without
creating
a
string
of
gobbledygook
that
you’ll
never
remember?
You
can
do
so
with
a
passphrase.
A
phrase
will
give
you
those
12
or
more
characters
mentioned
above,
and
with
a
couple
extra
steps,
can
turn
into
something
quite
unique
and
complex.
Here’s
a
three-step
example: 

1. 
   
   Pick
   a
   phrase
   that
   is
   memorable
   for
   you: It
   should
   not
   be
   a
   phrase
   you
   commonly
   use
   on
   social
   media
   accounts.
   If
   you
   are
   an
   avid
   runner,
   you
   might
   choose
   a
   phrase
   like,
   “Running
   26.2
   Rocks!” 
2. 
   
   Replace
   letters
   with
   numbers
   and
   symbols: Remove
   the
   spaces.
   Then,
   you
   can
   put
   symbols
   and
   numbers
   in
   the
   place
   of
   some
   ofthe
   letters.
   Runn1ng26.2R0ck$! 
3. 
   
   Include
   a
   mix
   of
   letter
   cases: Finally,
   you
   want
   both
   lower
   and
   uppercase
   letters
   that
   are
   not
   in
   a
   clear
   pattern.
   Algorithms
   know
   how
   to
   look
   for
   common
   capitalization
   patterns
   like
   
   
   camelCase
   
   or
   
   
   PascalCase.
   Runn1NG26.2R0cK$! 

Now
you
have
a
password
that
you
can
remember
with
a
little
practice,
one
that
still
challenges
the
tools
that
hackers
use
for
cracking
passwords. 

Creating
strong
passwords
with
a
password
manager 

When
you
consider
the
number
of
accounts
you
need
to
protect,
creating
strong,
unique
passwords
for
each
of
your
accounts
can
get
time
consuming.
Further,
updating
them
regularly
can
get
more
time
consuming
still.


That’s
where
a
password
manager
comes
in.  

A
password
manager
does
the
work
of
creating
strong,
unique
passwords
for
your
accounts.
These
will
take
the
form
of
a
string
of
random
numbers,
letters,
and
characters.
They
will
not
be
memorable,
but
the
manager
does
the
memorizing
for
you.
You
only
need
to
remember
a
single
password
to
access
the
tools
of
your
manager. 

A
strong
password
manager
also
stores
your
passwords
securely.
Ours
protects
your
passwords
by
scrambling
them
with
AES-256,
one
of
the
strongest
encryption
algorithms
available.
Only
you
can
decrypt
and
access
your
information
with
the
factors
you
choose.
Additionally,
our
password
manager
uses
MFA—you’ll
be
verified
by
at
least
two
factors
before
being
signed
in. 

Protecting
your
passwords 

Whether
it’s
the
passwords
you’ve
created
or
the
master
password
for
your
password
manager,
consider
making
an
offline
list
of
them.
This
will
protect
access
to
your
accounts
if
you
ever
forget
them.
Be
sure
to
store
this
list
in
a
safe,
offline
place—recognizing
that
you
want
to
protect
it
from
physical
theft.
A
locking
file
cabinet
is
one
option
and
a
small
fireproof
safe
yet
more
secure. 

A
password
manager
is
just
part
of
your
password
security
solution.
For
example,


you’ll
also
want
to
use
comprehensive
online
protection
software

to
prevent
you
from
following
links
in
phishing
attacks
designed
to
steal
your
account
login
information.
The
same
goes
for
malicious
links
that
can
pop
up
in
search.
Online
protection
software
can
steer
you
clear
of
those
too. 

In
some
cases,
bad
actors
out
there
will
simply
shop
on
the
dark
web
for
username
and
password
combos
that
were
stolen
from
data
breaches.


An
identity
monitoring
service

such
as
our
own
can
alert
you
if
your
information
ends
up
there.
It
can
monitor
the
dark
web
for
your
personal
info,
including
email,
government
IDs,
credit
card
and
bank
account
info,
and
more.
Ours
provides
early
alerts
and
guidance
for
the
next
steps
to
take 
if
your
data
is
found
on
the
dark
web,
an
average
of
10
months
ahead
of
similar
services.​ 

The
best
password
manager
makes
your
time
online
more
secure—and
simpler
too. 

A
password
manager
takes
the
pain
out
of
passwords.
It
creates
strong,
unique
passwords
for
every
account
you
have.
That
includes
banking,
social
media,
credit
cards,
online
shopping,
financial
services,
or
what
have
you.
The
entire
lot
of
it.  

And
remember,
remembering
is
the
thing
with
passwords.
Hackers
hope
you’ll
get
lazy
with
your
passwords
by
creating
simple
ones,
reusing
others,
or
some
combination
of
the
two
because
that
makes
it
easier
to
remember
them.
That’s
the
beauty
of
a
password
manager.
It
does
the
remembering
for
you,
so
you
simply
go
on
your
way
as
you
go
online.
Safely. 

Introducing
McAfee+

Identity
theft
protection
and
privacy
for
your
digital
life

Download
McAfee+
Now

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts