TL;DR

  • Unique: Don't use the same password twice.
  • Random: Use a password generator to create highly complex passwords which take advantage of the maximum length and character types allowed by the service.
  • Password Manager: Securely store your passwords so that they are accessible from any device you use.

How Do Passwords Get Broken?

Before we get to what strong passwords look like, it is important to understand how they are breached in the first place. There are generally two types of potential attackers, each following a different strategy.
  1. Attacker #1 knows you. It might be a family member, a spouse or child, or someone in your office. This kind of attacker will try to guess your password based on what they know about you — children's names, pets' names, a favorite vacation spot. This guessing based on known information is a form of social engineering attack.
  2. Attacker #2 knows nothing about you. They are going to use software to try millions of possible combinations to randomly stumble upon your password. This attacker's software will combine words from the dictionary, names, numbers, and other common bits of info that people tend to include in passwords to make them feel personal and easy to remember.
The kinds of passwords people typically use are designed to be easy to remember. In order to be easy to remember, they use references which are personal and unfortunately, weak to both forms of attacks described above.

Rules for Strong Passwords

The first rule is that every account in your life must have a unique password. Absolutely never use the same password twice because that is one of the easiest ways to fall victim to the domino effect where one breached account gives the attacker access to other accounts. A strong password strategy is a combination of a highly complex password and a way to remember or retrieve that information. A weak, easy-to-remember password is easy for an attacker to break, and a complicated password you can't remember won't do you any good either. The first thing to consider when crafting a password is that you want to take advantage of all of the options a given site, service, or form will allow. Common options include:
  • Upper and lowercase letters
  • Numbers
  • Symbols
The strongest possible password for a given service will include the use of all of those options while being the maximum allowed length. Each character adds mathematical complexity and increases your odds of security. The shortest passwords are always the first to be broken by automated software. With that in mind, it is advisable to use a password generator because the best result is made up of random characters. Random characters protect against attacker #1 (who is using personal knowledge) and attacker #2 (who is targeting references, words, and phrases commonly used by people). The ideal way to think about passwords is the way you do physical keys. You don't really know anything about the specifics of the shape of your key — you just reach for it and put it into the lock. A collection of unique, strong passwords properly secured in a password manager achieves the same effect.

Use A Password Manager

Most people store passwords either in their own head or through pen and paper. A password that is easy to remember is probably a weak one. Passwords written down physically can be viewed by people in your home or office, don't travel with you, and can't be copied and pasted. All of these hassles contribute to people choosing to use weak passwords. A password manager is an app or service which securely stores account information in a vault-like system. All of your data is stored in that secured environment, and then it is up to you to choose a strong password to secure the door to that vault. That one password becomes the only password in your life. Every other account login becomes as simple as clicking a button. Many of these services are cloud-based, so that you can access your passwords via your smartphone and through any computer you use. It is an elegant, modern solution to an old problem. The primary criticism is that you are creating a single point of failure. If that vault is accessed illicitly, the bad guys get everything. However, these password managers understand the threat and offer many methods of securing your vault beyond just a password, typically implementing some form of 2-Factor Authentication.