The old advice ("8 characters, a capital, a number and a symbol") produced passwords like Summer2024!: hard to remember and easy to guess. Modern advice is simpler: make it long, make it random, and don't reuse it.
Why length beats complexity
Attackers don't guess one character at a time; they try likely patterns first: dictionary words, names, dates, keyboard walks, and the same with "!" or "1" at the end. A password that looks complex but follows a pattern falls quickly.
Length adds far more work for an attacker than swapping letters for symbols. That is why a passphrase, several random words, is both stronger and easier to remember.
How to make a passphrase
- Pick five or more truly random words. Use dice and a word list (the "diceware" method) or a password generator, not words you choose yourself, because people pick predictable words.
- Join them with spaces or hyphens: velvet-orbit-cactus-lantern-ribbon.
- Picture a silly scene with the words in order. That is your memory hook.
- Never use it anywhere else.
Five random words from a large list are roughly as hard to guess as a random 12-character password with symbols, and far easier to type on a phone.
How long should a password be?
- Your vault passphrase and your email password: at least 5 random words, or 16+ random characters.
- Everything else: let a generator make 20+ random characters and store it in your vault. You never need to remember it.
You only need to remember two or three
That is the point of a password manager. Remember:
- The passphrase to your vault.
- The password to your email (it can reset everything else).
- Maybe the device password or PIN.
Everything else can be long, random and unique, because the vault remembers it. Potent Cipher includes a password generator and checks the strength of your vault passphrase when you set it, refusing weak ones.
Quick checklist
- Five or more random words, or 16+ random characters, for your most important accounts
- No reuse anywhere
- Two-factor authentication on email, banking and work accounts (where to keep the backup codes)
- A recovery plan for your vault, written down somewhere safe