How Passwords Actually Get Broken
Almost no account is lost to someone sitting at a login screen guessing. The real failure modes, in order of frequency: reuse (your password leaks from Site A and is replayed against Sites B through Z), phishing (you type the real password into a fake page), and offline cracking (a breached database of scrambled passwords is attacked with GPU rigs testing tens of billions of candidates per second). Understanding this ordering explains every recommendation that follows — and why "add a symbol" was never the answer.
Rule 1: Length Beats Cleverness
Cracking rigs work through candidates in order of likelihood: leaked passwords first, then dictionary words with common substitutions (P@ssw0rd falls in milliseconds), then brute force. Brute force is where math takes over: every added character multiplies the search space by the size of the character pool. The difference is not gradual — it is astronomical:
| Random password | Entropy | Offline crack time (100B guesses/sec) |
|---|---|---|
| 8 characters, all types | ~52 bits | ~7 hours |
| 12 characters, all types | ~78 bits | ~96,000 years |
| 16 characters, all types | ~104 bits | ~6 trillion years |
The catch: these numbers hold only for randomly generated passwords. A 16-character password built from your dog's name and an anniversary is not a 104-bit password; it is a handful of guesses dressed up long. This is the entire case for using a random password generator rather than your imagination.
Rule 2: One Account, One Password
Credential stuffing — replaying leaked email/password pairs across the web — is automated, industrial, and fast: breached pairs are typically tested against major sites within hours of a leak surfacing. Reuse converts one minor forum breach into a compromised inbox, and a compromised inbox into everything else via password resets. Unique passwords are the firewall between breaches. Since no human can memorize 80 unique random strings, this rule has a practical corollary: use a password manager. It remembers everything behind one master passphrase, and its autofill refuses to fill credentials on a look-alike phishing domain — quietly solving failure mode #2 as well.
Rule 3: Make the One Password You Memorize a Passphrase
Your password manager's master password must be memorable without being guessable. Four to six randomly chosen words — Cedar-Falcon-Drizzle-Anvil-Meadow — form a vivid mental image while drawing from a search space of hundreds of billions of combinations. Compose the phrase yourself and you lose most of that strength: human-made sentences follow grammar and word-frequency patterns that cracking dictionaries model explicitly. Our passphrase generator picks the words randomly; your only job is inventing the story that ties them together.
The Advice That Was Retired (and Why)
Forced 90-day password changes are gone. NIST's guidance (SP 800-63B) dropped scheduled resets years ago after research showed they push users into predictable increments — Summer2024! becomes Autumn2024! — which cracking software models trivially. Change a password when there is evidence of compromise, not on a calendar.
Composition rules ("must contain a symbol") are de-emphasized. They produced ritual compliance (capital first, ! last) rather than randomness. Length minimums and screening against known-breached passwords protect far better.
Security questions are effectively dead. Your mother's maiden name and first school are researchable facts. Where a site forces them, treat each answer as another random password: generate it, store it in the manager.
Beyond the Password: Two-Factor Authentication
Even a perfect password can be phished in real time. Two-factor authentication means a stolen password alone is not enough. The hierarchy, weakest to strongest: SMS codes (vulnerable to SIM swapping) → authenticator apps → hardware keys / passkeys, which are phishing-proof because the credential is bound to the real domain. Enable the strongest option each account offers, starting with email and banking — email first, because it is the reset key to everything else.
The 15-Minute Action Plan
Install a reputable password manager. Create its master passphrase with the passphrase generator (six words) and practice typing it a few times. Then fix your four highest-value accounts — email, banking, cloud storage, social — by generating a unique 16-character random password for each and switching on two-factor authentication as you go. Let the manager absorb the long tail of remaining accounts gradually as you log into them. Fifteen minutes of setup removes you from the population that credential-stuffing attacks are built to harvest.