Staying Safe Online · Passwords & Sign-ins · Lesson 1 of 5

What Makes a Strong Password

Why long beats clever, and how three random words make a strong password.

Long beats clever

A password is a secret word or phrase that proves an account is yours. An account is your own space on a website or app, like your email or your bank.

Many people think a strong password needs odd symbols, like P@$$w0rd#. That kind of password is hard for you to remember. It is not very hard for a computer to guess.

Attackers use programs that try millions of guesses very fast. The thing that slows them down most is length. Each extra letter makes the number of possible guesses grow a lot.

So a long password is usually stronger than a short, clever one.

An easy way to make a long password is a passphrase. A passphrase is a password made of a few words strung together. The UK's National Cyber Security Centre suggests using three random words, like this:

• cactus pillow river
• lamp tiger noodle

The words should be random. They should not make a sentence or a saying you'd find in a book.

A passphrase is easy to picture in your head. Picture a cactus sitting on a pillow in a river, and you will remember it.

On the practice computer, type a short password into the meter and see how weak it is. Then type a passphrase of three or four random words, and turn on two-step verification in the pretend account settings.

What attackers guess first

Guessing programs do not start at random. They start with the passwords people use most.

Lists of common passwords are easy to find. Words like these are always near the top:

• password, password1
• 123456, 12345678
• qwerty, the top row of letters on a keyboard
• iloveyou, letmein

A guessing program tries these first, in seconds.

Next, attackers try personal information. This means facts about your life, like your pet's name, your child's name, your birthday or your street. Many of these facts are easy to find on social media.

So a password like Fluffy2015 is weak. Anyone who has seen photos of your cat might guess it.

Small changes don't help much either. Swapping an "o" for a zero, or adding "1" or "#" at the end, are tricks the programs already know.

Here is a quick check for any password:

1. Is it long, at least three words or 15 letters?
2. Is it free of names, dates and places from your life?
3. Is it something that isn't on a list of common passwords?

If you answer yes to all three, you are in good shape. Next, you'll learn why each account needs its own password.