Password Security Guide
How to Create a Strong Password
A strong password is one of the simplest defenses for an online account. The goal is to make a credential difficult to guess while keeping it unique to the service where it is used. A password generator can help by removing predictable patterns and personal information from the process.
Length Matters
Password length has a major effect on the number of possible combinations. Increasing the length of a password can dramatically expand the search space available to an attacker. When a service supports long passwords, use a length that fits its limits and security requirements.
Use Unique Passwords
Do not reuse an important password across multiple websites. If one service experiences a breach and your password is reused elsewhere, attackers may try the same credentials on other services. Unique passwords reduce this chain reaction.
Use a Password Manager
A password manager can generate, store and autofill unique credentials, making it much easier to avoid password reuse. Instead of memorizing dozens of complex passwords, you can protect your password vault with a strong master credential and appropriate multi-factor authentication.
Why Randomness Is Important
Human-created passwords often contain predictable patterns, names, dates, keyboard sequences or common substitutions. A cryptographically strong random source is preferable when generating passwords because it reduces predictable patterns.
What Is Password Entropy?
Entropy is an estimate of uncertainty or unpredictability. A simplified estimate can be calculated from password length and the size of the character pool. This is only an approximation. Real-world password security also depends on how the password was generated, whether it is unique, whether an attacker has leaked information about the user, and the defenses used by the authentication system.
Should You Include Symbols?
Symbols can increase the available character pool, but length and uniqueness are also extremely important. Some websites impose restrictions on allowed symbols, so always follow the password policy of the service you are using.
Passwords and Multi-Factor Authentication
A strong password should be combined with multi-factor authentication when available. MFA adds another layer of protection, so a stolen password alone may not be enough to access an account.
Never Share Your Password
Do not send passwords through ordinary chat messages, email or social media. If you need to give someone access, use the service's official sharing or delegated-access features when available.
Generated Passwords Are Not Encryption
A password generator creates credentials. It does not encrypt your account or guarantee that a website's authentication system is secure. Protect your devices, keep software updated and use trusted services.