Why Strong Passwords Still Matter (and What’s Next)
Release Updates
- Improved the strength model with better penalties for common passwords, l33t-style substitutions, repeated runs, date-like patterns, and low character variety.
- Reworked crack-time output into clearer scenarios for rate-limited online attacks, fast offline hashes, and PBKDF2-based estimates after benchmarking.
- Upgraded the PBKDF2 timing tool with run-state protection, browser support checks, iteration clamping, and automatic reuse of measured throughput in the main analysis.
- Refined the results panel with more honest labels, checklist-style suggestions, and clearer risk flags for production use.
A strong password is your first and often only line of defense against account takeover. Most breaches do not involve movie-style hacking; they start with credential stuffing (attackers try passwords leaked from other sites), weak or reused passwords, phishing, or brute forcing simple patterns like Summer2024!. The goal of a strong password is to be hard to guess both by humans and by automated tools, and unique so that one breach doesn’t unlock everything else.
What makes a password “strong”?
- Length first: Aim for at least 15–16 characters for important accounts. Long passphrases made from unrelated words resist guessing better than short, complex-looking strings.
- Unpredictability: Avoid common words, keyboard runs (qwerty), dates, names, and simple substitutions such as
P@ssw0rd. - Uniqueness: Never reuse a password across services. If one site is breached, attackers will try those credentials elsewhere.
Modern password guidance
Current password guidance puts length and usability ahead of rigid composition rules. Sites should allow long passwords, spaces, and Unicode where possible, and should not force arbitrary mixtures of uppercase, lowercase, digits, and symbols. For memorable passwords, the NCSC’s “three random words” approach is a practical way to create something long enough and easier to remember. For accounts stored in a password manager, a long random password is usually better.
Use a password manager & turn on MFA
Password managers generate and store long, unique passwords for every account—so you only remember one strong master password (or use a passkey/biometric). Combine this with multi-factor authentication (MFA) wherever available. Even if a password leaks, an attacker still has to pass an extra barrier like a one-time code, authenticator app, or hardware key.
“Sign in with Google/Apple” and passkeys
Using a trusted identity provider (e.g., Sign in with Google) can reduce password sprawl. You delegate login to an account you protect well (with MFA and alerts), and the site never stores your password. An even more modern option is passkeys (FIDO2/WebAuthn), which replace passwords with public-key cryptography tied to your device, resistant to phishing and credential stuffing. Where supported, passkeys are a strong, user-friendly choice.
A quick note on “post-quantum” security
Large-scale quantum computers could threaten some public-key algorithms (like RSA and classic elliptic-curve cryptography), which are used for things such as TLS certificates and some login protocols. Password security is a bit different: websites should store passwords using slow, salted hash functions (e.g., bcrypt, scrypt, Argon2) designed to frustrate offline cracking—even with powerful hardware. While quantum advances are being addressed with post-quantum cryptography for key exchange and signatures, the practical takeaway for users remains the same: choose strong, unique passwords (or passkeys) and enable MFA. Doing this dramatically reduces risk today and sets you up well for tomorrow’s cryptography upgrades.
Practical tips you can apply right now
- Create a long passphrase from unrelated words, following the same idea as the NCSC three-random-words approach.
- Store it in a reputable password manager; let it generate unique ones for other sites.
- Turn on MFA everywhere—prefer app-based or hardware keys over SMS where possible.
- Consider sign-in options like Sign in with Google or passkeys to reduce password reuse and phishing exposure.
- Change weak or reused passwords first on email, banking, and primary identity accounts.
This checker runs entirely in your browser—no passwords are uploaded. Results are estimates to help you spot obvious weaknesses. Real-world security also depends on the site’s hashing scheme, rate limits, breach history, and whether you use MFA or passkeys. It does not check live breach databases.