What Makes a Strong Password (and Why Length Beats Complexity)

Passwords are the front door of your digital life, and most of us were taught the wrong rules for them: swap an "a" for an "@", add a capital letter and an exclamation mark, change it every few months. In this lesson you will learn how passwords are actually attacked, why length matters far more than tricks, and how to create passwords that are strong and still possible to remember.

In Chapter 1 you mapped your attack surface and saw that reused passwords and stolen logins are one of the attackers' favorite shortcuts. We now start closing that door, beginning with the most basic question: what is a good password?

How passwords are really attacked

Attackers rarely sit and guess your password by hand. They use automation, and the main methods are worth knowing because they explain every recommendation that follows.

• Credential stuffing: when a website is breached and its list of email and password pairs is stolen, attackers automatically try those same pairs on many other services. This works whenever you reuse a password.
• Dictionary attacks: programs try very common passwords, words from the dictionary, names, dates and the usual variations ("Summer2024!"). Clever-looking substitutions are in these lists too.
• Brute force: trying every possible combination, systematically. This takes more time as the password gets longer.
• Guessing from personal information: your pet's name, your birth year, your favorite team, anything found on your social profiles.
• Phishing and malware: tricking you into giving the password or recording it. No password, however strong, resists this on its own, which is why the next lessons add other layers.

Notice that only the last two attack the password itself. The first ones exploit weak or reused passwords, and those are the ones you can fix today.

Why length wins

Imagine a combination lock. A lock with four digits has ten thousand possible combinations. Add one digit and it jumps to a hundred thousand. Each extra character multiplies the number of possibilities that an attacker must try. That multiplication is why length is the single most effective lever.

Complexity helps a little, because mixing character types enlarges the pool of possible characters at each position. But the gain is modest compared with adding characters, and complexity has a hidden cost: people respond to complexity rules by creating predictable patterns. We all do it: capital letter first, number and symbol at the end, "a" becomes "@". Attackers know those habits and build them into their tools.

Compare these two:

• P@ssw0rd!: nine characters, looks complex, but appears in practically every list of common passwords.
• lantern-biscuit-orbit-mango: four unrelated words, 27 characters, easy to picture and far harder to crack.

This is the principle of the passphrase: several random words strung together. It is long, and easy for a human to remember.

How to build a good passphrase

1. Choose words randomly, not a quote, a song lyric or a sentence about your life. Randomness is the key ingredient. A dice-based method or a random word generator is ideal. If you pick words yourself, avoid anything connected to you.
2. Use at least four words, and five or six for the most important accounts (your email and your password manager).
3. Add a separator or a twist if you like, but do not rely on it as the main protection.
4. Make it unique: a passphrase is only useful for one account.

Other rules that actually matter

• One password per account. This is the most valuable rule of all. If one service is breached, the damage stays there.
• Avoid personal information: names, birthdays, addresses, phone numbers, pet names.
• Avoid minimal modifications, such as adding a "1" to the old password or changing the year. Attackers try these first.
• Do not change your passwords on a fixed schedule for no reason. Current guidance from national security agencies, including NIST in the United States, discourages forced periodic changes, because people respond by making small predictable tweaks. Change a password when you suspect it was exposed, when a service reports a breach, or when you shared it with someone.
• Never share a password by message or email. If a service legitimately needs to be shared, it should offer a proper sharing feature.
• Do not use the security questions honestly. "What is your mother's maiden name?" can be found by anyone who researches you. If a service insists, treat the answer as another password: invent a random answer and store it securely.

The problem of numbers

If you have 80 or 100 accounts, you cannot memorize a unique strong passphrase for each of them, and nobody can. That is not a personal failing; it is simply a problem of human memory. The solution is not to reuse, and not to write everything on a sticky note under the keyboard. It is to remember only a few very strong passphrases and let a tool remember the rest. That tool is the password manager, and it is the subject of the next lesson.

In practice, you should memorize passphrases for:

• Your password manager (the "master" passphrase).
• Your main email account, since it can reset all the others.
• The unlock code or password of your devices, which you type many times a day.

Check whether your passwords are exposed

Large data breaches happen regularly, and your email address is probably in some of them. Reputable breach-notification services let you check whether an address appears in known leaks, and many password managers include this check. If a password you still use appears in a breach, change it, and everywhere you reused it. You can find guidance about handling leaks on the website of the French agency cybermalveillance.gouv.fr, and the national equivalent exists in many other countries.

Your turn

Exercise. Rank these passwords from weakest to strongest and explain why.

1. Marie1987!
2. tr0ub4dor&3
3. correct-planet-violin-thunder-pebble
4. Qw3rty!2024

See a solution

From weakest to strongest: 4, 1, 2, 3.

• Qw3rty!2024 is based on a keyboard pattern and a year: it is among the first things any tool tries.
• Marie1987! mixes a first name, a likely birth year and a symbol at the end, so it is very predictable and easy to guess from a social profile.
• tr0ub4dor&3 uses a short word with common substitutions. It looks complex, but it is short and follows known patterns.
• correct-planet-violin-thunder-pebble is long, made of unrelated words, and still easy to remember. If the words were chosen randomly, this is by far the best choice, as long as it is not reused anywhere else. (Do not use this exact example of course, since it is now public.)

Add to your Security Notebook

Create the heading "2. Accounts and passwords". Write the three passphrases you must memorize (without writing the passphrases themselves!) and note which one you still need to create. Generate your new master passphrase now, using four to six random words, and practice typing it a few times.

The next lesson introduces that tool: the password manager, and how to start using one without stress.