Strong passwords you don't have to remember
Why length beats clever symbols, why every account needs its own password, and how a password manager makes that easy. You'll leave knowing exactly how to set one up.
LENGTH WINS
Predictable is weak, however complex it looks
Password-cracking tools don't try every combination in order. They start with what people actually do: a word with a capital first letter, a year or birthday, a ! at the end, @ for a, 0 for o. So "Tehran1402!" looks complex but sits near the front of the queue. Current guidance, such as from the US standards body NIST, favours length over forced symbol rules.
"P@ssw0rd2024" ticks every box on a sign-up form and is still one of the first things a cracker tries. "lantern cactus river mosaic pepper" breaks every old rule and is far harder to guess.
A passphrase of words picked truly at random
from a list of 7,776 words (a common word list):
1 word 7,776 possibilities
3 words 7,776 × 7,776 × 7,776 ≈ 470 billion
5 words 7,776^5 ≈ 28 billion billion
Each extra random word multiplies the work by 7,776.5 random words: about 2.8 × 10^19 possibilitiesThe words must be chosen at random (a generator or dice), not by you. A song lyric or famous line is long but predictable.
Check yourself
Kian needs a new password for his email that he'll sometimes type by hand. Which choice is strongest?
- K!@n1995, since it mixes symbols, numbers and capitals
- A whole line from his favourite famous song, typed with its spaces and punctuation
- Five words picked by a generator: cactus river lantern pepper mosaic
- His Instagram password with a 2 added to the end
Show the answer
Five words picked by a generator: cactus river lantern pepper mosaic
Right. Random words give length without a pattern. A famous lyric is long, but cracking tools use lists of well-known phrases, and his name plus birth year is one of the first guesses.
ONE EACH
Unique matters more than clever
A brilliant password used on ten sites is only as safe as the weakest of those ten. If one leaks, the other nine are open (lesson 1). So the real rule is: every account gets its own password. Two old rules are gone too: you don't need to change passwords on a schedule, only when there's a sign one leaked, and a small edit to an old password doesn't count as new.
Changing "Sara1370" to "Sara1371" every few months feels safe but isn't. Attackers who have the old one try the obvious next versions.
THE TOOL
A password manager remembers for you
A password manager is an encrypted vault for your passwords. You remember one strong master password; it remembers the rest. It can generate a long random password for each new account and fill it in when you log in. Your phone and browser usually have one built in, and there are dedicated apps too.
Signing up for a new shop: the manager suggests something like "vR7#qL2m..." with 20 characters, saves it, and fills it in next time. You never see or type it.
Check yourself
Hannah thinks keeping all her passwords in one manager is riskier than using one memorable password everywhere, because "it puts all her eggs in one basket". She's right.
Show the answer
False
False. With one password everywhere, a single leak from any site opens everything. With a manager, a leak from one site exposes only that site, and the vault itself is encrypted behind a master password that's never used anywhere else. Protect the vault well and it's far safer.
What changes when a manager does the work
Passwords in your head
A few passwords, reused and slightly changed. You type them into whatever page asks, including fake ones.
Passwords in a manager
A long random one for every site. It fills in only on the exact site address it was saved for, so on a look-alike page it stays silent.
Check yourself
Current good advice, or an outdated habit?
- Letting a manager generate a random password for each site
- Adding 1 to the end of your password every three months
- Changing a password right after a site says it was breached
- Using your child's name and birth year with a ! at the end
- A master password of five random words used nowhere else
- Reusing one very strong password on all your accounts
Show the answer
Good practice: Letting a manager generate a random password for each site, Changing a password right after a site says it was breached, A master password of five random words used nowhere else
Outdated or risky: Adding 1 to the end of your password every three months, Using your child's name and birth year with a ! at the end, Reusing one very strong password on all your accounts
Set up a manager this week
- 1 · Pick one
The one built into your phone or browser is a fine start. A dedicated app works across different devices and brands.
- 2 · Make a strong master password
Five or more random words you've never used anywhere. Write it on paper at home until you know it by heart.
- 3 · Protect the vault
Turn on two-step login for the manager or the account it's tied to (lesson 3), and save any recovery key it gives you.
- 4 · Move accounts in gradually
Start with your email. Then each time you log in somewhere, let the manager replace the old password with a new random one.
Check yourself
Arash clicks a link about his bank account. The page looks exactly like his bank, but his password manager, which always fills his bank login, offers nothing. What should he do?
- Copy the password from the manager and paste it in, since the manager is probably glitching
- Stop, since the address is likely fake, and open his bank app himself
- Type the password by hand this time and update the manager later
- Reinstall the password manager and try the link again
Show the answer
Stop, since the address is likely fake, and open his bank app himself
Exactly. A manager matches the real site address, not the look of the page. When it stays silent on a page that looks familiar, treat that as a warning, not a bug.
Lesson recap
- Length and randomness beat symbols; predictable patterns are guessed first.
- Every account needs its own password; change one when it leaks, not on a timer.
- A password manager generates, remembers and fills unique passwords for you.
- Guard the manager with a strong master password and two-step login.
- If the manager won't fill a familiar-looking page, suspect a fake.