Why Do Passwords Matter?
Your passwords protect everything from your school accounts to your email, social media, and bank account. If someone guesses or steals your password, they could read your private messages, steal your personal data, or even impersonate you online.
Choosing strong passwords and using them carefully is one of the most important things you can do to stay safe online.
What Makes a Password Strong?
A strong password is one that is difficult for humans and computers to guess. The key factors are:
| Factor | Weak | Strong |
|---|---|---|
| Length | 6 characters | 12+ characters |
| Characters used | Letters only | Letters + numbers + symbols |
| Predictability | "password123" | Random or passphrase |
| Uniqueness | Same for every site | Different for every account |
Never use: your name, birthday, pet's name, or the word "password". These are the first things an attacker will try. Common weak passwords like "123456" and "password" are cracked in under a second.
How Attackers Crack Passwords
Understanding attack methods helps you understand why strength matters:
- Brute force: Tries every possible combination. A 6-character password of lowercase letters has only 26⁶ ≈ 300 million combinations — a fast computer cracks this in seconds. A 12-character mixed-character password has vastly more possibilities.
- Dictionary attack: Tries common words and variations ("password", "p@ssw0rd"). Avoid real words or simple substitutions.
- Phishing: Tricks you into typing your password into a fake website. No password strength helps here — use HTTPS and check URLs carefully.
- Data breach reuse: If your password is leaked from one website, attackers try it on other sites. Never reuse passwords.
Tips for Choosing Good Passwords
- Use a passphrase: A string of random words like
correct-horse-battery-stapleis long, memorable, and very secure. - Use a password manager: Software like Bitwarden or 1Password generates and remembers unique strong passwords for every site. You only need to remember one master password.
- Enable two-factor authentication (2FA): A second verification step (like a code texted to your phone) means that even if someone has your password, they still cannot log in.
Using a password manager is the single best practical step most people can take to improve their online security. It allows you to have a completely unique, long, random password for every account without needing to remember any of them.
Password Length and Entropy
The strength of a password can be measured by entropy — roughly how many guesses an attacker would need. Longer passwords and a wider set of characters both increase entropy dramatically.
Adding just one more character to a password roughly multiplies the number of possible combinations by the size of the character set (e.g. 94 for printable ASCII). Length matters more than complexity.
Practice Problems
A password is made up of only lowercase letters (26 options per character). How many possible combinations exist for an 8-character password? Why is this less secure than a 12-character password using the same characters?
Show answer
Explain why using the same strong password on multiple websites is still a security risk.