Most password advice still in circulation was written for a threat model that no longer exists. "At least eight characters with a number and a symbol" was reasonable when attackers guessed passwords one at a time against a live login form. It is close to meaningless against someone who has stolen a database and is testing billions of candidates per second on their own hardware.
Here is what actually determines whether a password survives, and what to do about the parts you control.
Length beats complexity, and it is not close
Password strength comes down to how many possibilities an attacker has to work through. Each additional character multiplies that number by the size of the character set. Adding a symbol to an eight-character password multiplies the work by a small factor. Adding four more characters multiplies it by millions.
This is why Tr0ub4dor&3 is a weak password and correct horse battery staple is a strong one, despite the first looking more "complex". The first is a dictionary word with predictable substitutions — and cracking tools have applied those substitutions automatically for two decades. The second is long, and length is what costs the attacker time.
A passphrase of four or five genuinely random words is easy to remember, quick to type, and vastly stronger than the mangled-word passwords complexity rules push people toward.
The crucial word is random. Words you chose yourself are not random — people reach for the same concepts, and attackers know it. Let a tool pick: our Password Generator produces both random-character strings and passphrases.
Reuse is the real vulnerability
If you take one thing from this article: a unique password per site matters more than the strength of any individual password.
Breaches are routine. When a site is compromised, the stolen credentials get tested automatically against every other major service — email, banking, shopping, work systems. This is called credential stuffing, and it is the mechanism behind most account takeovers.
A perfect 30-character password used in two places fails the moment either of those places is breached. A merely good password used in exactly one place does not.
Nobody can memorise a hundred unique passwords, which is why a password manager is not a convenience but the thing that makes unique passwords possible. One strong passphrase you actually remember, protecting everything else.
What happens to your password on the server
Understanding this explains why some breaches are catastrophic and others are shrugged off.
A competently built service never stores your password. It stores a hash — the output of a one-way function. Verifying a login means hashing what you typed and comparing. Someone who steals the database gets hashes, not passwords.
But not all hashes are equal, and the differences matter enormously:
- MD5 and SHA-1 are broken for this purpose. They were designed to be fast, which is exactly wrong for passwords — speed helps the attacker test candidates. Commodity hardware runs billions per second.
- Unsalted hashes mean identical passwords produce identical hashes, so an attacker cracks once and unlocks every account sharing that password. A salt is random data added per user to prevent this.
- bcrypt, scrypt and Argon2 are designed to be deliberately slow and memory-hungry, with a tunable cost factor that can be raised as hardware improves. These are what a service should be using.
You can experiment with hash functions in our Hash Generator to see how the same input maps to a fixed-length output, and how a single character changes it completely. Worth noting: the fast hashes there are appropriate for checksums and file integrity, not for storing passwords.
Two-factor authentication: the biggest single upgrade
Passwords are something you know. If that is the only barrier, a stolen password is a compromised account. A second factor — something you have — means the password alone is not enough.
The options are not equivalent:
- SMS codes. Better than nothing, and meaningfully weaker than the alternatives. SIM-swap attacks — where someone convinces a carrier to move your number to their SIM — are a real and well-documented technique, particularly against high-value targets.
- Authenticator apps (TOTP). A six-digit code derived from a shared secret and the current time, generated on your device with no network involved. Nothing to intercept in transit. This is the sensible default for most accounts. Our TOTP Generator shows how the codes are derived.
- Hardware keys and passkeys. The strongest option, because the secret never leaves the device and authentication is cryptographically bound to the real site — which means they resist phishing in a way codes cannot. A convincing fake login page can capture a TOTP code; it cannot capture a passkey.
Turn on two-factor for your email first. Email is the recovery channel for everything else, which makes it the single most valuable account you own. An attacker with your email can reset most of your other passwords regardless of how strong they are.
Store recovery codes properly
When you enable two-factor, you are given backup codes. These bypass the second factor entirely, which makes them as sensitive as the password itself.
Do not photograph them into your camera roll, and do not email them to yourself — that puts them in the account they are meant to protect. Print them, or store them in your password manager under a separate entry.
Sharing a credential without emailing it
Sometimes you genuinely have to give someone a password or a key. Email and chat are poor channels: both create permanent copies in places neither party controls, often synced and backed up indefinitely.
A one-time link is much better — the recipient opens it once and the content is destroyed. Our One-Time Secret tool does exactly this. For a file rather than a string, AES Encryptor lets you encrypt it and send the passphrase through a different channel entirely.
Sending the file by email and the password by phone is a genuine improvement, because it requires an attacker to compromise two unrelated systems.
Advice worth discarding
Forced periodic changes
Mandatory rotation every 90 days is now explicitly discouraged by major security guidance, because of how people respond to it. They pick Summer2026! and then Autumn2026!, which is entirely predictable. Change a password when you have reason to think it is exposed, not on a calendar.
Security questions
Your mother's maiden name and the street you grew up on are not secrets — they are often publicly available. Where you cannot avoid these, answer with random text stored in your password manager. There is no rule that the answer must be true.
Password hints
Any hint useful enough to remind you is useful enough to help an attacker. Leave them blank.
A realistic thirty-minute plan
- Pick a password manager and secure it with a long random passphrase from the generator. This is the one you memorise.
- Enable two-factor on your email using an authenticator app. Save the recovery codes offline.
- Fix your top ten accounts — email, banking, primary shopping, work, anything holding payment details. Unique generated password for each.
- Check your exposure. Breach-notification services will tell you which of your accounts have appeared in known breaches. Change those first.
- Let the rest happen gradually. Update each remaining password as you next log in. Trying to fix everything in one sitting is how people abandon the project.
The short version
Long beats complex. Unique beats strong. Two-factor beats almost everything else you could do. And your email account is the master key — protect it first, and protect it best.
The password generator, hash generator, TOTP generator and one-time secret tools are all free on ZeeSharp.