What is a Secure Password?
A password is a string of characters (letters, numbers, and symbols) used to authenticate your identity and prevent others from accessing your digital accounts. In today's highly connected internet age, almost every digital service requires an account. As such, it is critical to understand how to construct a strong password (or use a password generator) and how to take active measures to safeguard it.
Understanding Password Strength & Entropy
Password strength is a measure of how effective a password is against being guessed or broken via "brute-force" attacks (where software tests every possible combination). Password strength is effectively an estimate of how many trials would be required, on average, for a computer to successfully guess the password.
This strength is determined by the length, complexity, and unpredictability of the password. If a password involves a person's name, birthday, or other personal information, it makes for an incredibly weak password that can be broken instantly using a dictionary attack.
What is Password Entropy?
This password generator determines password strength via password entropy, measured in bits. The higher the entropy, the more difficult it will be for the password to be guessed. The formula used is roughly E = L * log2(R) where L is the length and R is the pool of possible characters.
In the context of a brute-force search, a password entropy of 100 bits would require 2100 attempts for all possibilities to be exhausted. On average, a hacker would need to exhaust about half of those possibilities before finding the correct password. Modern security standards recommend an entropy of at least 60-80 bits for important accounts.
Rules for Creating a Strong Password
Creating a secure password means prioritizing randomness and length. Below are the core rules that should be followed for generating a strong password:
- Include a mix of lower-case letters [a-z].
- Include a mix of upper-case letters [A-Z].
- Include numbers [0-9].
- Include special symbols [!@#$%^&*].
- Length over Complexity: A 20-character password made entirely of lowercase letters is mathematically harder to crack than an 8-character password with symbols. Aim for a minimum of 16 characters for critical accounts.
- Exclude words involving your personal information (pet names, birth years).
- Exclude passwords that match common formats such as calendar dates or phone numbers.
Why Exclude Ambiguous Characters?
The generator provides an option to exclude ambiguous characters. This includes characters like the capital letter "I", lowercase "l", and the number "1". It also includes the letter "O" and the number "0". These characters can be incredibly difficult to distinguish from one another depending on the font used by an app or website. Confusion arising from ambiguous characters could potentially lock you out of your own account if you try to type it manually. However, remember that excluding characters slightly lowers the overall mathematical entropy of your password pool.
How to Protect Your Passwords
Protecting your password is as important as coming up with a strong one. Below are standard cybersecurity measures you should take to protect your accounts:
- Never reuse passwords: Although it may be more convenient, having the same password across multiple websites means that a security breach on one poorly secured website compromises the safety of all your accounts.
- Use a Password Manager: A password manager generates, stores, and auto-fills unique, complex passwords for every site you use. You only need to remember one strong "Master Password."
- Enable Two-Factor Authentication (2FA): Also known as Multi-Factor Authentication (MFA). Even if a hacker discovers your password, they cannot access your account without the secondary code sent to your phone or authenticator app.
- Never save passwords on public devices: Do not check the "Remember Me" box on public or shared computers (libraries, cafes, hotels).
- Do not keep obvious physical lists: A sticky note on your monitor or a plain text document on your desktop named "passwords.txt" opens you up to unnecessary risk. Store them in a secure, encrypted manager.