Password Security Guide: Start Here

Most password advice fails for the same reason: it either drowns you in jargon or hands you a rule without the reason behind it, so the moment the rule is inconvenient, you drop it. This page is the opposite. It’s the short, plain-English orientation I’d give anyone who wants to actually understand their own security rather than just obey it — built from years in IT watching which habits hold up and which quietly cause the damage. Read this top to bottom and you’ll have the whole mental model. Each section links to a deeper dive when you want one.

The one idea that matters most: length beats complexity

If you take a single thing from this entire site, make it this. The strength of a password is governed far more by its length than by how many odd symbols it contains. Every character you add multiplies the number of possibilities an attacker must try — growth that’s exponential with length but merely incremental with complexity.

That’s why a 16-character string of plain words beats an 8-character tangle of $%& symbols, and why the old “uppercase, number, symbol” ritual was always solving the wrong problem. The modern standards bodies agree: favour length. The practical form of that is the passphrase — four or more random, unrelated words. Long enough to defeat brute force, simple enough for a human to remember. Full method in how to create a strong password.

How passwords actually get broken

You can’t defend against an attack you’ve pictured wrongly, and most people picture it wrongly — a hacker typing guesses into a login box. That barely happens; sites lock you out fast. The real attacks run offline, against stolen databases, with no limits. The four you should know:

Brute force tries every possible combination in order. Guaranteed to work given time — so your job is to make “time” mean centuries, which length does.

Dictionary attacks try known words, common phrases and previously leaked passwords first. Brutally fast against anything human-chosen, which is why a real word — however you dress it up — is weak.

Credential stuffing takes an email-and-password pair leaked from one breached site and tries it automatically across thousands of others. This is the reason reuse is the cardinal sin: one careless forum can unlock your email and bank. The fix is a unique password everywhere, which in practice means a password manager.

Phishing skips the cracking entirely and just tricks you into typing your password into a fake page. No password length saves you here — awareness does. Here’s the field guide. I go through the full attacker’s playbook in how hackers break into accounts.

The mistakes that undo good intentions

Even people who try hard fall into predictable traps: reusing one password, building a Base+SiteName system, swapping a→@ and thinking it helps, or recycling Summer2026! every quarter because a policy forces a change. Cracking tools are tuned for exactly these patterns. The full list, with how each attack plays out, is in the 10 password mistakes I see cause real damage.

What I’d actually have you do

Strip it all down and modern password security is four habits:

1. Use a password manager. It removes reuse and memory limits in one move — the highest-leverage thing on this page. Which ones I recommend.
2. Make everything long. Passphrases for what you must remember; long random strings (from the manager) for everything else.
3. Turn on two-factor authentication on your important accounts — app or hardware key over SMS where you can. The 2FA guide.
4. Never log in via a link someone sent you. Go to the site yourself. That one habit defeats most phishing.

What the standards bodies say

For what it’s worth, this isn’t just my opinion — it’s where the official guidance has landed too. NIST (the US standards body) now recommends favouring length over complexity, screening passwords against known-breach lists, and abandoning arbitrary expiry rules like the 90-day reset, because forcing frequent changes makes passwords weaker, not stronger. The UK’s NCSC says much the same in friendlier language. I link both, and other primary sources, on the Resources page.

Ready to put it into practice? Test a password’s strength or generate a secure passphrase — everything runs locally in your browser, and nothing you type is ever stored or sent. And when you want the long-form treatment, the Complete Guide to Password Security in 2026 goes deeper on every point above.