Welcome to the very start of 25th Word. You do not need to know anything about computers or crypto to read this. Everything else on the site builds on the ideas here, and each guide below answers one simple question. This is part of Everyday passwords.

Start with what a password does

A password is a secret that proves an account is yours, as we explain in what a password is, and why it matters. Anyone who has it can act as you. That is why a password is worth a little care, and why no real company will ever ask you for it.

The three ways to prove it is you
Something you know
A password, PIN or passphrase
Something you have
A phone or a security key
Something you are
A fingerprint or your face
A password is the first kind of proof. Adding a second kind, such as a code from your phone, is what two-factor login means.

The three rules of a strong password

Almost all password advice comes down to three rules:

  1. Long. Length does more than anything else. Our guide on how long a password should be gives practical numbers.
  2. Random. Humans are predictable, so learn what makes a password weak, what symbols and numbers really do and what strength means.
  3. Unique. Never reuse a password, so that one leak stays one leak.
Each extra character multiplies the work
8 lowercase letters10 seconds
8 mixed characters3.5 days
12 lowercase letters55 days
10 mixed characters85 years
16 lowercase letters69,000 years
12 mixed characters750,000 years
16 mixed characters59 trillion years
Average time to find a randomly generated password at 10 billion guesses a second, a rate attackers can reach offline against stolen passwords protected with a fast hash. Well-protected sites are far slower to attack, and human-chosen passwords fall far sooner. Bars use a log scale. Compare them with each other rather than reading them as a guarantee.

The easy way to follow the rules

Nobody can memorize a long random password for every account. The realistic approach has two parts. Let a password manager create and remember almost all of them, and memorize just a few strong passphrases made of random words. Our step-by-step guide shows you how to create a strong password both ways.

Then move on to crypto, if you need to

If you own crypto, or plan to, one more kind of secret needs different handling. Read why a seed phrase is not just another password, then continue to our Crypto secrets section.