For years we were told: a capital letter, a number, a special character. The result — we all have Company2024! and think we are safe.
That password can be guessed in seconds. Not because it is short, but because it is predictable.
How passwords are really cracked
Nobody tries “aaaa, aaab, aaac”. The programs start from a list of millions of real passwords from previous breaches, then try the obvious variations: Company + year + exclamation mark.
If your password follows a pattern that millions of people follow, complexity doesn’t help.
Length wins
Four random words are stronger than eight mixed characters — and you can remember them.
coffee-window-seven-cloud
Twenty-five characters, easy to type, impossible to guess. The key is that the words are random, not a sentence that makes sense.
The rule most people break
The same password in several places. This is more dangerous than a weak password.
When a website is breached — and that happens all the time — your address and password end up on a list. The first thing attackers try: the same combination on your email, your bank and your hosting.
Check whether you appear in a breach at haveibeenpwned.com. Most people do, and don’t know it.
A password manager
You can’t remember forty different passwords. Nobody can — that is why everyone uses the same one.
A password manager remembers them for you. You remember one, the master password.
Bitwarden is free and enough for most people. 1Password and KeePass are good choices too.
The most common objection: “What if the manager gets hacked?” A fair question — but the data is encrypted with your master password, which the company doesn’t have. And the risk is far smaller than the alternative: the same password everywhere, or on a note under the keyboard.
Two-factor login
Even a perfect password can be stolen. The second factor — a code from an app on your phone — means the password alone isn’t enough.
Turn it on at least for: email, hosting, banking and social networks. Email matters most — it is how all the others get reset.
What not to do
- Don’t change your password every 30 days for no reason — that leads to
Company1,Company2 - Don’t send passwords by email or Viber
- Don’t use personal details — your name, date of birth, car registration
Want someone to keep an eye on things for you — updates, backups and monitoring?
Maintenance →