Passwords are everywhere, securing our digital identities, but what’s the best way to make a good one?

What’s the difference?

A passphrase, similar to a password, is simply a memorable phrase or arrangement of words. Because they are lengthy by virtue of what they are, they are much harder to crack, making them a logical use as a password.

For example, a password looks like angel08, while a passphrase might be sittinginmyrockingchair.

How are they compromised?

• Relentless frienemies: A “friend” might be able to guess your passwords or the answers to your security questions by using social engineering attacks.
• Brute-force attacks: An attack that works by trying all possible password combinations until the right one is found.
• Data breaches: Usernames and passwords may be compromised if a site is hacked and its data is breached.
• Phishing attacks: A type of fraud where an attacker tries to get sensitive information by posing as a reputable entity, like a bank or Denison, through email, IM, or other communication channels.

How do I make a strong password?

Making a strong password isn’t super complicated! Using these simple steps, you can create a strong and robust password for your online identities.

• Make them long
• Make them hard to guess
• Use unique passwords

Perhaps it’s not surprising, but a lot of research has gone into the science of password cracking and guessing, since it’s the core to making good, strong password guidelines. The results of that research can be tested right here! We’ve included a “password strength tester” for you to play with. We don’t store or transmit your password (everything’s done in your browser)—feel free to dig into the JavaScript on this page to verify!

Looking for ideas? Try: qwerty, password, p@$$word, zhang198822, and WhyfaultthebardifhesingstheArgives'harshfate?

If you’re mathematically or computationally inclined, I also suggest checking out the research presentation given at USENIX 2016 on password strength estimation. We’ve cited it below. It’s a fantastic resource!

Make them long, not hard to type

A long password is a lot harder to guess by brute force. As you tested passwords out, you’ve probably realized a simple cheat code: longer passwords are stronger.

Traditional wisdom was that you needed complexity: a combination of character types (uppercase, lowercase, numbers, and symbols). But, we’ve since learned that length is the most important factor in a password’s relative strength.

You might’ve noticed how passphrases don’t have to have symbols. While adding complexity might not hurt, it also might not help (and make it more difficult to type).

That also extends to so-called “l33tc0de,” or replacing letters with numbers or symbols. For example, you can replace the capital letter ‘O’ (oh) with the number ‘0’ (zero). Or, you can replace the lowercase letter ‘l’ (el) with the number ‘1’ (one). These permutations are often easy to guess: easy enough that the password strength checker can detect them.

Make them hard to guess

To this point, we’ve covered how passwords should be long. It’s also important to avoid common phrases and personal information that could easily be guessed. If you tried out the password strength tester, you might’ve noticed how including certain words or patterns caused your password’s strength to decrease.

Common words and phrases are good for attackers. They’ll often try these words (and variations on them) first. So, come up with passwords and passphrases that avoid (or drown out) any common words and phrases.

It’s also worth nothing how not all of our personal information is exactly private. Think about it: using the information you’ve posted online on social media, could someone guess what your birthday or your pet’s name is? Using voter registration information, could someone find your address? The point is: this information isn’t secret, and a determined attacker will try these phrases and permutations of them.

Use unique passwords

Imagine (or think back, if this has happened): you just woke up, grabbed your phone from your nightstand, and instinctively tried to open Instagram. Strange, you were signed out unexpectedly! So, you go to your text messages, where a few of your friends tried to let you know that your profile’s been “hacked!”

Chances are, the hacker didn’t use anything sophisticated to get into your account. The hacker might’ve just guessed the password, or you might have given it up in a phishing message.

Now, the hacker knows your password! Bad thing. Worse when you realize that you used the same password on Facebook, Twitter, Bluesky, and Snapchat.

Hackers, on learning about or breaching your password, will immediately start to try to use that same password on all of your other accounts, counting on you having reused that password. This is a type of cyberattack called a password spray attack.

Stopping this type of attack is simple: just use unique passwords. If all of your passwords are unique, then the password spray attack just doesn’t work anymore. The attacker can try, but they won’t be able to actually get into any accounts that weren’t using that password.

Use a password manager

Now, while easy in theory, it can sound daunting: that’s a lot of passwords to remember! Many of us have dozens, if not hundreds of online accounts.

A password manager is like a secure, digital notebook that’s designed to hold passwords. Make sure you follow the other tips we’ve provided to create a strong password for your password manager, and you’ll have a formidable digital fortress.

While we don’t provide direct endorsements, we recommend 1Password or Bitwarden for most folks. Both of these password managers have browser extensions and mobile apps (with an offline mode), so you’ll always have access to your passwords. 1Password gives a little bit more hand-holding if you’re not too tech-savvy, while Bitwarden gives you more controls and transparency over the working bits.

Citations

D.L. Wheeler. “zxcvbn: Low-Budget Password Strength Estimation.” 25th USENIX Security Symposium, August 2016. [Online.] Available: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler.