“Use a strong password” is advice without a reason attached, which is why so few people follow it properly. The reason lives in what happens after a company you signed up to gets broken into — and once you have seen that, the rest of the advice sorts itself into the parts that matter and the parts that never did.
The tool Password Generator Strong passwords and passphrases, made on your machine and never transmitted anywhere.The site should not have your password at all
A well-built site does not store what you typed. It stores a hash: the output of a one-way calculation. Feeding the same password in always produces the same hash, and there is no way to run the calculation backwards.
So when you log in, the site hashes what you typed and compares it with the hash it has. It never needs the original, and it never has it.
That is the theory, and it is why a breach is not automatically a catastrophe. Whether it is one in practice depends on two details that nobody outside the company can see from the outside.
Detail one: salt
If a site hashes passwords with nothing else added, every account using the same password gets an identical hash. An attacker who works out one has worked out all of them at once, and can spot the most common passwords just by looking for repeated values.
A salt is a random value stored alongside each account and mixed in before hashing. Identical passwords now produce completely different hashes, so each one has to be attacked separately, and precomputed tables of common hashes are useless.
Salting is not new and is not optional in any serious system. Breaches that make headlines for exposing millions of passwords are frequently breaches of systems that skipped it.
Detail two: how slow the hash is, which sounds backwards
This is the part that surprises people, and it decides everything.
Hashes built for speed — the ones designed to fingerprint files quickly — can be computed on ordinary graphics hardware at rates in the billions per second. Those are exactly the wrong tool for passwords: the attacker with the stolen list gets to make billions of guesses a second against it.
Hashes built for passwords are deliberately, expensively slow, and can be tuned slower as hardware improves. The same graphics card manages perhaps tens of thousands of guesses a second instead of billions. Those numbers are orders of magnitude rather than precise figures — they depend on the hardware and the settings — but the gap between them is the whole point, and it is a gap of roughly a million times.
Same stolen file, same password. Against the fast hash, a weak one falls in seconds. Against the slow one, the same guessing run would take longer than anyone will wait.
Then the part that is actually about you
Everything so far is the company’s decision, not yours. Here is the part that is yours, and it is the one that does the damage.
Once a set of email addresses and passwords is out, the next step is not to attack anything. It is to take those exact pairs and try them, automatically, at hundreds of other sites — banks, shops, mail providers, social accounts. This is called credential stuffing, and it does not involve guessing at all. It is just typing in an answer that is already known.
It works for exactly one reason: the same password was used somewhere else.
So notice what that means. If every account has its own password, a breach is confined to the site that was breached. The strength of the password barely enters into it — a stuffing attack does not care how strong yours is, only whether it is the same one. A weak, unique password is safer against this than a very strong, reused one.
That is the whole argument for a different password everywhere, and it is a better argument than “because it is more secure”.
The advice that got reversed
For years the standard rule was to change every password every ninety days, and to require an uppercase letter, a digit and a symbol.
Both have been walked back by the people who wrote them, including in the United States’ own federal guidance, and the reason is that both produced worse passwords in practice rather than better ones:
- Forced rotation made people cycle predictably. Summer2024! becomes Autumn2024!. An attacker who has one has a very good idea of the next.
- Composition rules made people decorate the same word the same way — capital at the front, digit and exclamation mark at the end. A guessing program knows that pattern perfectly well, so the rule widened the alphabet on paper and narrowed the real search.
The current guidance is the opposite in both cases: allow long passwords, do not force periodic changes, and check new passwords against lists of ones already known to have leaked. Change a password when there is a reason to — not on a calendar.
If you want to see what that looks like from the guessing side, the strength checker breaks a password into the pieces a guesser would recognise and prices each of them, which is usually more persuasive than being told.
What follows from all this
Four things, in the order they matter:
- A different password for every account. This is the one that stops a breach spreading, and nothing else does.
- Something to remember them with. Nobody memorises forty. A password manager is the ordinary answer; a notebook that never leaves your house is better than reuse.
- Two-factor authentication where it is offered, and especially on the mailbox everything else resets through. A stolen password alone stops being enough.
- Length over decoration. Once each password is unique, longer is the lever that still helps — and a generated one has no pattern for a guesser to find.
Notice that only the last of those is about the password itself. The advice everybody repeats is the least important item on the list.