Weak and outdated password practices remain one of the most exploited vulnerabilities in cybersecurity. This content covers how passwords are compromised, what current guidelines recommend, and how to build stronger password habits using length, complexity, and multi-factor authentication.
Password Security
Bad passwords are a huge issue on our cyber security domains. What I found is that there's a lot of users out there that just don't know how to create good passwords or manage their passwords very well, and if they do know, I find that a lot of them just don't do it — they just think that it's too much of a problem for them, and so they don't manage their passwords very well. Or I find that there's a lot of cyber security specialists out there that are operating off of old password guidelines. That's right: professionals out there operating off of old password guidelines. The guidelines change, and some of the guidelines might even shock you, of what they're recommending nowadays.
As we go through good passwords, good password habits, bad passwords and bad password habits, I'm going to actually give a rating when I come up with one of the recommendations. I'll rate it on how important I think it is in implementing these good password habits, and how detrimental these bad password habits are. I feel like there's a lot of recommendations out there that we just put out there because, yes, it's better — but is it really all that better?
Just a quick reminder that your passwords are hacked because either they're known somehow — like a key logger or eavesdropping, or maybe you've told the hacker, so they're known — or they are guessed. A hacker could have guessed a password because they were trying everything, or perhaps they were trying all the common passwords that are out there, maybe they were just trying different dictionary words, maybe it was from some sort of known information about you, maybe it's credential stuffing, maybe it's some sort of mask attack where they see that there's some sort of pattern that you have.
With credential stuffing, remember there are databases out there. You have accounts at all of these different institutions, and if those institutions, if those organizations, if those vendors, if those companies were compromised and your username and password was compromised, that ends up in these databases that can be purchased or even just downloaded for free, that hackers use to hack into systems. So if you are reusing your password, that's a bad thing, because that password could be already compromised.
Hackers also use rainbow tables. Rainbow tables are those tables that they use to take an encrypted password to look up what the plain text password is. So the rainbow table is already figured out, but the thing is, it's only figured out up to a certain amount of characters, and it's only figured out for certain combinations, so it has to be prepopulated. Which means if you have a bigger, more complex password, it becomes less likely that it's going to show up on a rainbow table.
Password length is one of the most important things you can do to make a secure password. Let's take a look at the reason why.
First of all, let's say you have 26 lowercase letters to work with, you have 26 uppercase letters to work with, you have 10 numbers to work with, 0 through 9, and you have — let's say we'll throw 10 special characters in there. So that's a total of 72 characters right there.
So if you were to just have a one character password, and that's the total length of the password, then I could try 72 times and I'm guaranteed to get in with 72 tries, because you only have a one character password. But now if I have a two character password, then that's 72 different options times 72 options; that's significantly more. 72 times 72 is significantly more than 72. Now take a three character: that's 72 times 72 times 72, and that's actually 373,000.
So I don't want to get too much into the math, but this just means this is a three character password, four character, five character, six, seven, eight character password. This means that there's three zeros following this, so that makes this 373,000, so that means that there's 373,000 possibilities if you've got a three character password. Now add one more character to that, and now you have five zeros. If you add one more character to that, now you have seven zeros. If you have one more, you have nine zeros after that. So it increases by two zeros every time.
That's the difference between 10 and a thousand, and that's the difference between a thousand and 100,000. I mean, these are exponentially larger numbers. So every time you add another character, your password becomes so much more secure.
So what does that guard against? Well, number one, it guards against people guessing your password; it makes it really hard to guess your password. It also helps protect you against rainbow tables — not a guarantee, but it helps protect you against that.
So what is the current recommendation for the length of a password? Well, I'm not going to put that in there, because it actually changes over time. It used to be eight characters, and a lot of people do eight characters, but I would do way more than that. So I would do a little research to find out how many characters you should use. Right now I'm using at least 16. I think the going recommendation is 12 right now, but I do at least 16 characters for my passwords.
So how helpful is password length? Well, as we saw here, a smaller password is really in the negative here, but a bigger password — if you've got three characters, then it's really low on this list; if you've got five characters, it's more so. The more characters you have, the more to the right this goes; it's helpful. So I don't even have a spot on here, because it just continually increases and gets more helpful the more characters you have.
Then we have complexity. Complexity means you're using multiple variations of uppercase and lowercase and numbers and special characters.
I've got a little bit of math here too. Let's say we use an 8 character password. If I'm using an 8 character password, then I have 72 possibilities, which is the example we gave before. But let's say I just refuse, I'm not going to use special characters, I refuse to use special characters, so that means I just cut 10 possibilities for each one of those characters, so now that's 62 to the 8th power. Let's say I decrease it by, I refuse to do numbers; and if I refuse to do numbers, then I decrease that to 52 to the 8th power. Maybe I refuse to do even uppercase, I just want to do lowercase, then that's 26 to the 8th power.
So if you look at the math here, the difference: I have 12 zeros with 72 to the 8th power, 11 zeros with 62 to the 8th power — got a little bit of a drop there — with 52 to the 8th, and 9 zeros with 26 to the 8. Once again, this is the difference between order of magnitude, or the difference between 10 and a thousand. That's pretty significant right there, but that is pretty minute compared to the character length.
So complexity really doesn't matter as much. I put this really low on the scale, because we overemphasize complexity. Really, it still protects us against some password guessing, and kind of protects us against rainbow tables — really, length is going to be the thing that protects us against rainbow tables, so it kind of protects us against that. I say complexity is not really all that important. Really, the reason for complexity is because we had shorter password recommendations before. I'd much rather tell my users to make your password longer in length and don't worry about the complexity as much.
Then we have substitutions. This is where we replace things like the a with the at symbol, or s's get replaced with dollar signs, or zero replaces o.
This is really low on the list. Does it help a little bit? Kind of. It kind of protects against password guessing, it kind of protects against these rainbow tables, but not really, because everybody knows what you substitute, everybody knows you use dollar signs for s's, and so it really doesn't add much protection for it. So substitutions, I don't even bother with.
Misspellings really don't help all that much. They kind of help used in conjunction — both this and the substitution, used in conjunction with other things, may help quite a bit more — but for the most part, by itself, it doesn't really protect against guessing, and it doesn't really protect much against rainbow tables, just a little bit.
One other recommendation is to change your password often. So let's give a little example here. Let's say that a bank had usernames and passwords stolen from it, and so there was this event that happened: usernames and passwords were stolen. Well, what's going to happen? Those hackers are going to start trying to attack those accounts and get into those accounts and steal the money, and that's going to happen relatively quickly maybe. And so the biggest exposure time here is right at the beginning.
But maybe they've stolen thousands or hundreds of thousands or millions of different usernames and passwords, and they can't get to it all. Or maybe they're selling this information out there, and so it's in the process of exchanging hands, and so it could go for a long time before anybody ever attempts to use your username and password. So it's more sensitive up front, but it becomes less likely as time goes on.
Well, why is this important? Because changing passwords helps us stop this from being exposure after the point in time you change the password. And the point I'm trying to make here is, you still are exposed during this time, but what happens is that you're not exposed after that.
So a lot of times we like to think that this is a great thing to do — and it is a great thing to do, it does make a difference; in fact, I might even put this a little bit higher than what I have right here — but you still are exposed at the more critical time right here. So it doesn't help possibly as much as you would hope it would. And it's a big problem, it's a lot of work to go and change all your passwords on a consistent basis.
So do I actually do this? I only do this for key accounts, for things that I really need to be careful with, things like bank accounts — I don't want people to access my bank account. And so I don't change my passwords often; I'm very strategic about which accounts and how often I change those accounts.
For that same reason, we would want to change our password if we feel like there's something suspicious, or have concerns that our account may have been compromised. So that's definitely when you want to change your password.
Then you have multifactor authentication. With a password, somehow they need to steal it or somehow they need to guess at it, but once you add multifactor authentication to a great password, you go off the charts. So if you notice here, I put the dot way out here, because this is a huge step in securing your accounts, and when you implement this, this is far superior than any other password hint or tip or anything else that I could provide for you.
Because think about it: they have to have access to whatever device it is that you're using multifactor authentication for — that is in the case where you're using something that you have. So in this case right here, let's say I have my cell phone. They would have to have access to my cell phone, or somehow they need to see the code on my cell phone and know my password, or maybe somehow they trick me into divulging the code that's on my cell phone. So this becomes very difficult once you start implementing things like multifactor authentication. So it is a huge help to securing your accounts.
And then, one password per account. This is really important; I put this pretty high on our scale here.
Let's give a little scenario here. Let's say that this company is a gaming company, and you have your username and password on there, and you use the same password for your bank account. The thing is that this gaming company that has your username and password is not going to be as critical, and they're not going to treat your data as important as a bank would treat your data. And so there is a higher probability that your username and password will be stolen from this gaming company.
And what will happen is, if that data is stolen — and it could be an external threat, or some sort of breach that's happened, or it could be just the disgruntled employee that steals all the usernames and passwords — and then starts going and hacking bank accounts. So you really have to watch out for this. This is one of those things that I am very adamant about: every single one of my accounts has a different username and password to it, and they're all very unique.
On a similar note, variations. They understand that each one of your accounts needs to be a separate password, but they'll use something like password at chess for this gaming company, and then they'll use password at bank for this bank company. Well, all I would need to do is take a look at your password there and I would know how to reverse engineer that. And also, you may think that you're pretty clever in how you disguise how you insert this bank or chess or whatever your code is into your password, but the problem is that if I'm doing credential stuffing and I have some past passwords that have been hacked, I can take that and I can do some analysis on it to reverse engineer and find out what your passwords are, what kind of combination you have. So variations don't really work.
So what I've marked here is, if you're using a password per account, it pretty much nullifies or takes away from that, and it can vary a little bit depending on what your secret little code is, but just in general I would actually put this maybe even down here at the bottom. It just really takes away from your other efforts that you're making. So it makes your account susceptible to credential stuffing, and to people being able to see what your password actually is for your different sites.
If you're transmitting or storing your passwords in an unsecure manner — for instance, no encryption — that's a big no-go. This is going to be definitely on the negative side. This pretty much nullifies most of the other stuff you could do with this, because somebody can easily find digital records, and if it's unencrypted and they can see it, essentially it's like rolling the dice. You're just rolling the dice whenever you're transmitting your password via clear text.
I don't do any secure passwords or anything through email, and I see that happen a lot: people are passing stuff like that through email, passing Social Security numbers through email. I don't know how many times I have had HR people ask me to send information through email thinking it's secure, and it's not. So do not do this. This is like rolling the dice; somebody's going to get that information eventually.
Repetition in your password can weaken it. I'm not going to have a rating with this, because it's going to depend on how much repetition. So if you've just got a couple of characters, or a few characters, that you're repeating within your password, not a real big deal, it's not going to be very much on the negative side. But what happens is there's some people that are just putting a bunch of characters to get past whatever the minimum length is: they would put a bunch of repeating characters. So really, this no repetition is against some stupid password behavior. I hope no one is practicing stupid password behaviors. So don't do repetition — or maybe just do it if it's really small amounts of repetition, that is okay, but don't do anything extensive.
Sequence history, meaning that when you change your password you're using some sort of sequence, is going to be a negative impact to your passwords. That is, it's going to make it more susceptible to somebody figuring out what your sequence is. All I need to do is do some analysis on it to figure out what your sequence is. And so really, this makes you susceptible if somebody sees your past history. So people who are credential stuffing, or internal threats, somebody that has access to your database that's internal, might be able to see what your repetition is and be able to figure it out.
Patterns is another thing that can be a giveaway for your passwords: things like if you're repeating numbers or letters, or even keyboard patterns, can be figured out. So be careful with any kind of patterns that you use in your password.
Dictionary words is also what hackers use to try to hack accounts, and so don't use dictionary words — or you can kind of use them.
What I mean by that: I haven't put a line down here at the bottom, because if you were to use just a single dictionary word, you'd be way down here, it would be off the charts, maybe way, way down here. But if you use two dictionary words that really are not associated with each other at all, then I might bump it up, and you might be just at a bit of a negative here. Maybe you use three different dictionary words, all not related to each other; now I think you're kind of in the positive there, that's not a bad thing to do. If three more complex dictionary words that are unrelated, bump it up to four, and now I'd say that's a pretty good password, that's pretty decent.
So here again, just be smart about the way you use dictionary words. You could use them, but use them in a certain manner that makes it more secure. Make sure you're not doing stupid dictionary words in your password.
Common phrases or quotes also can be easily guessed. So something like Singing in the Rain is probably a common password that's out there, and I would put it pretty low on our negative scale here. But as with a lot of these things, we can actually change this. If I were to actually use a quote like Singing in the Rain but add some complexity to it — now, I don't really like substitution, but I could add some complexity, maybe add two quotes that are very different, add them together and do something creative with that — I could actually change this from being a real negative to being a real positive password.
It's common for hackers to use personal information to try to guess passwords, so don't use anything with dates or addresses or people's names. It just makes it all that much easier for somebody to guess, and so I put this pretty low on the list here.
Don't write down your passwords. If you're writing down your passwords, then it doesn't have to be guessed at all, somebody can see the password. So if you're writing it down on sticky notes and putting it on your screen or something, that is going to be just a given: people are going to see your password.
Do not reuse old passwords. I put this pretty far down on the negative list. Reusing old passwords makes you susceptible to that credential stuffing and any kind of internal threats. So don't reuse old passwords.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →