By the end of this lesson you will be able to
- Explain why length and unpredictability make a password strong.
- Build a passphrase from random, unconnected words.
- Explain why reusing a password is dangerous, using the idea of a data breach.
- Describe what a password manager does and how to choose one safely.
- Use the password strength explorer with made-up examples only.
A password is the key to a room full of your private things, and most people keep the same key on every door. This lesson shows what actually makes a password hard to break, and the one change that helps most: a different password for every account, held by a tool that remembers them for you. You will never be asked to type a real password into any lesson or lab here, and you should never type one into any practice tool.
How passwords get broken
Criminals rarely sit and guess your password one try at a time. They use three main methods. The first is guessing with a list: programmes try the most common passwords, such as “password123”, names, dates and keyboard patterns, millions of times a second. The second is {{brute-force|brute force}}: trying every possible combination, which takes longer and longer as the password gets longer. The third, and by far the most important, is using a password that has already leaked. When a company is hacked, a data breach, its users' passwords can be copied and sold. Attackers then try those same emails and passwords on other websites, which is called credential stuffing.
This is why the rule that matters most is not “add a symbol”. It is never reuse a password. A strong password used in two places is only as safe as the weaker of the two places.
Read this figure as text
A sequence diagram: a small shop site is breached, the criminal gets the password list and then tries it on an email service and a bank.
Actors: Amina, a small shop website, a criminal, her email service and her bank. Step 1: Amina signs up to the small shop with her email and a password she also uses elsewhere. Step 2: the criminal breaks into the shop and copies its list of emails and passwords. Step 3: the criminal tries Amina's email and password on her email service. Step 4: because it is the same password, the email service lets the criminal in. Step 5: from her email the criminal asks the bank to reset the password, and gets access. One weak, small site led to the loss of the more important ones, because the password was reused. All names are fictional.
What makes a password strong
Two things: length and unpredictability. Each extra character multiplies the number of possible passwords. And a long password made from common words in a common order is not unpredictable, because attackers' lists already contain those patterns. Replacing letters with symbols in a predictable way (“P@ssw0rd”) does not help, because attackers try those swaps too.
- Short: summer2024
- A name, date or team
- Predictable swaps: P@ssw0rd
- Same password everywhere
Do not use.
- 14 or more characters, longer is better
- Random words: kettle-orbit-plank-seven-marsh
- Different for every account
- Kept by a password manager
Examples only: make your own.
Read this figure as text
Two columns showing weak password habits and strong ones with fictional examples.
Weak: short, such as the made-up example summer2024. Based on a name, date or favourite team. Predictable swaps such as P@ssw0rd. The same password on many accounts. Strong: long, at least 14 characters and often much more. Made of random words or characters that do not make a known phrase, for example the made-up passphrase kettle-orbit-plank-seven-marsh. A different password for every account. Remembered by a password manager, not by your head. These are examples only: never use a password from any lesson.
Passphrases: long but memorable
A passphrase is a password made of several random words, such as the made-up example “kettle orbit plank seven marsh”. It is long, so it is hard to guess, and it is easier for a person to remember than a jumble such as “q7%Zp!2x”. The crucial word is random. Words must be picked by chance, for example by rolling dice against a word list or using a manager's generator, not chosen because they mean something to you. A line from a song or a sentence about your family is far easier to guess.
You need to memorise only a few passphrases: one for your password manager, one for your email, and one for your computer login. For every other account, let a password manager create and remember a long random password.
kettleword 1random-separatororbitword 2random-separatorplankword 3random-separatorsevenword 4random-separatormarshword 5randomRead this figure as text
A passphrase of five random words separated by hyphens, each word labelled.
The made-up passphrase kettle-orbit-plank-seven-marsh has five random words joined by hyphens. Each word was chosen by chance and has no link to the others or to the owner. Five words make a long password, and the separators make it easier to read and type. It is only an example and must never be used for a real account.
Practise: password strength explorer
Try made-up passwords and passphrases and see why length and unpredictability matter. The lab runs in your browser and sends nothing anywhere, but you should still use only invented examples.
Loading lab…
Password managers
A password manager is a programme that stores all your passwords in an encrypted vault, locked by one strong passphrase (the master passphrase). It creates long random passwords for each account and fills them in for you. Because it fills in only on the correct website address, it also helps against fake sites: if the manager does not offer your login, the address is not the one it knows.
- Step 1: Master passphraseThe one secret you memorise
- Step 2: Vault unlocksEncrypted on your device
- Step 3: Unique passwordsLong, random, one per site
- Step 4: Auto-fillOnly on the correct address
Read this figure as text
A flow of four steps: one master passphrase unlocks the vault, which fills in a unique password for each site.
Step 1: you remember one strong master passphrase. Step 2: it unlocks your encrypted vault on your device. Step 3: the vault holds a long, random, different password for every site. Step 4: when you visit a site with the correct address, the manager fills in the right password. If the address is a fake, the manager does not fill anything in, which is a warning sign.
Options include the manager built into your browser (Firefox, Chrome and Edge all have one), and dedicated managers such as Bitwarden (free to use, open source) or KeePassXC (a free programme that keeps the vault in a file on your own computer). Pick one from the maker's official website or your system's app store, read its reviews, and avoid unknown ones with a long list of permissions. Whichever you choose, back up the vault and write your master passphrase on paper kept in a safe place at home until you know it by heart.
Common mistakes
✖ Instead of: Using one “very strong” password everywhere.
✔ Do this: One password for many accounts is one key for many doors. Use a unique one for every account.
✖ Instead of: Choosing a phrase that means something to you, such as a pet name plus a year.
✔ Do this: Meaning makes it guessable. Choose random words, or let the manager generate characters.
✖ Instead of: Saving passwords in a document called “passwords” on the desktop.
✔ Do this: Use an encrypted password manager, and keep a paper copy of the master passphrase at home until you remember it.
✖ Instead of: Forgetting the master passphrase because it was never written down or practised.
✔ Do this: Write it on paper in a safe place, use it daily for a week and keep recovery details for the manager.
If something goes wrong
- A site rejects my long password.
- Some sites limit length or symbols. Use the longest password the site allows, and let the manager generate one that fits the rules shown.
- The password manager does not fill in a login.
- Check the address in the bar is the one you saved, and that the manager is unlocked. If the address is different, do not fill it manually: the site may be fake.
- I cannot remember my master passphrase.
- Look at the paper copy. If you have no copy, use the manager's recovery option if you set one up. Otherwise the vault cannot be opened, which is why a paper copy matters.
Key terms
- Passphrase
- A long password made of several unrelated words, which is hard to guess yet easy to remember.
- Password manager
- An app that stores all your passwords safely and fills them in for you, so you remember only one.
- Data breach
- An incident in which a company's stored information, such as passwords or emails, is stolen or exposed.
- Brute force
- Guessing passwords by trying huge numbers of possibilities automatically.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Design a passphrase on paper
Without using any real account, create a practice passphrase from five random words. Open a book at a random page, or use a word list, and pick words by chance rather than by meaning. Write them on paper, join them with hyphens and say them aloud three times. Then tear up the paper. This is practice: do not use this passphrase anywhere.
Challenge: find your highest-risk reuse
Without writing any passwords down, list your five most important accounts (for example email, bank, phone, main social media, shopping). For each, ask yourself: do I use a similar password for another account? Mark which accounts are at risk, and choose the first one to change. Then choose a password manager to try and note where you will keep your master passphrase on paper.
Knowledge check
7 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- Passwords are broken by guessing lists, brute force and, most of all, by reuse after breaches.
- Length and unpredictability create strength; clever character swaps do not.
- A passphrase of several random words is long and still memorable.
- A password manager lets you use a different long password everywhere, and fills them in only on the right site.
- Never type a real password into practice tools or into any page that is not the real sign-in page.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- Password managers: Using a password manager (National Cyber Security Centre (UK))
- Three random words (National Cyber Security Centre (UK))
- Bitwarden help centre (Bitwarden)