Passwords: The Complete Guide

Most people handle passwords the same way: they pick something they can remember, maybe substitute a number for a letter or add an exclamation point at the end, and use slight variations of it everywhere. This approach feels reasonable. It is, in practice, not much better than nothing — and I'm going to show you exactly why, and what to do instead.

A lot of what follows comes from years of listening to Steve Gibson on Security Now!, the podcast that taught me most of what I know about practical security. Steve has spent more hours thinking rigorously about passwords than almost anyone alive. I'll attribute his specific insights where they appear.

How Attackers Actually Crack Passwords

To understand what makes a password strong or weak, you first need to understand what an attacker is actually doing. There are three main approaches, in order of how they're tried:

1. Credential dumps — the fastest attack: Your email and password were in a breach at some other site (LinkedIn, Adobe, Yahoo, any of thousands of others). The attacker takes those exact credentials and tries them at every major service — your bank, Gmail, Amazon. This is called credential stuffing, and it works because the average person uses 6–7 passwords across 25+ accounts. If you reuse passwords, a breach at a low-security site hands over the keys to everything.
2. Dictionary and rule-based attacks: Your password isn't in a dump, so the attacker tries a dictionary of common words, names, and phrases — then applies rules: capitalize the first letter, add common suffixes (123, 2024, !!), swap letters for numbers (E→3, A→@, O→0), reverse the word, append the word to itself. Every trick you think is clever has been catalogued.
3. Brute force — trying everything: When all else fails, the attacker tries every possible combination — A, B, C... AA, AB... The size of the space they have to search determines how long this takes. This is the only attack that pure length defeats.

Why "Clever" Is Broken

Steve Gibson dedicated a full episode to this in 2012: "Password Cracking Update: The Death of Clever" (Security Now! #366). The conclusion is blunt, and it's gotten more true every year since:

Everything you think is a clever password trick, attackers already know about. This isn't speculation — it comes from analyzing hundreds of millions of real-world passwords from actual breaches. The most common "clever" moves and their status:

The Haystack Insight: What Actually Matters

Steve Gibson had a breakthrough realization that he published as the Password Haystacks concept (Security Now! #303). It reframed password security in a way that most conventional advice misses.

The key insight: what protects you in a brute-force attack is not the complexity of your password — it's the size of the search space the attacker has to cover. An attacker trying every possible combination starts at the low end (short passwords, simple alphabets) and works outward. The longer your password, and the more character types it uses, the further out in that search space it lives.

The math is stark. Using the full 95-character printable ASCII alphabet:

Every character you add multiplies the search space by ~95. One more character is not "a bit stronger" — it's 95 times harder to crack by brute force. This is the exponential growth that makes long passwords categorically different from short ones.

The One Rule That Matters for Search Space

Before a brute-force attacker tries the full 95-character alphabet, they try smaller alphabets first — because 46.67% of all passwords are all lowercase. So they try all-lowercase passwords out to a long length before touching any password that contains uppercase, digits, or symbols.

This means: you need at least one character from each type (uppercase, lowercase, digit, symbol) to force the attacker out of the abbreviated searches. Once you've done that, length is everything.

Password Padding: The Practical Technique

Gibson's Password Haystacks page at grc.com/haystack.htm demonstrates a technique he calls password padding: take a memorable base — even a simple dictionary word — and pad it with a consistent pattern of your own invention.

Examples of the concept (don't use these exact patterns — invent your own):

• correct...horse...battery...staple — spaces or dots as separators between memorable words
• ....MyDog....MyDog — your phrase padded symmetrically
• [[[[[Swordfish]]]]] — surrounding brackets + a memorable word
• !-!-!-Spartan-!-!-! — a pattern you can reproduce from memory

The padding takes the password out of any dictionary or rule-based attack and pushes it so deep into brute-force territory that no hardware that will ever exist can find it in a reasonable time. The memorable word in the middle is irrelevant to security — the length and character mix are doing the work.

Password Reuse: The Real-World Threat

Even a perfect password at one site can be catastrophic if you use it elsewhere. The attack is called credential stuffing: when a site gets breached and passwords are cracked, attackers take those email+password pairs and automate login attempts across hundreds of services simultaneously. Your Netflix password gets you into Gmail. Your Gmail password gets you into everything else.

The scale of this problem is not academic. The average person uses roughly six to seven distinct passwords across twenty-five or more accounts. That means most accounts share credentials with at least a few others. When any one of those sites is breached — and some site where you've registered has almost certainly been breached — the domino effect begins.

The rule is not negotiable: every site gets a unique password. The only practical way to do this for most people is a password manager.

Password Managers: The Actual Solution

A password manager generates, stores, and fills long, random, unique passwords for every site you use. You remember one strong master password. The manager does the rest.

This is not optional for anyone serious about security. It's the only way to have genuinely random, genuinely unique passwords everywhere without requiring superhuman memory.

Your Master Password

The one password you have to remember — the master password for your manager — deserves real thought. It's the one exception to "let the manager generate it." Apply the haystack principle: long, padded with something unique to you, containing all character types. This is the one you genuinely memorize. Make it 20+ characters. Use something you can recall under stress but that no one else would guess or find.

How Sites Store Passwords — and Why It Matters to You

When a site is breached, what the attacker gets is not usually your plaintext password — it's a hash of it. A hash is a one-way mathematical transformation: the same input always produces the same output, but you can't reverse it to get the input back. When you log in, the site hashes what you type and compares it to the stored hash.

The quality of the hashing matters enormously:

You usually can't know which algorithm a site uses. The practical implication: assume any site you've ever used could be breached and could have weak hashing. Your defense is unique passwords — so a cracked hash at site A doesn't help the attacker at site B.

Multi-Factor Authentication: The Layer That Changes Everything

Even a perfect unique password can be phished — you type it into a convincing fake login page, and the attacker has it. Multi-factor authentication (MFA) adds a second requirement that the attacker doesn't have even if they got your password.

Enable MFA on everything that matters. Prioritize: email first (it's the master key to everything else), then financial accounts, then password manager, then everything else. If a site only offers SMS, enable it anyway — it's still dramatically better than nothing.

Passkeys: The Future That's Already Here

Passkeys are the technology the industry has converged on to replace passwords entirely. They use the same asymmetric cryptography that TLS uses, applied to authentication.

When you create a passkey for a site, your device generates a public/private key pair. The site stores the public key. Your device keeps the private key, protected by your biometric (Face ID, fingerprint) or PIN. To authenticate, the site sends a challenge; your device signs it with the private key; the site verifies with the public key. No password ever crosses the network. No shared secret exists that can be phished or breached.

• Phishing-resistant: The key is cryptographically bound to the domain. A fake login page gets nothing useful.
• Breach-resistant: The site only stores a public key. Even if it's stolen, it can't be used to log in.
• No reuse risk: Each passkey is unique per site by design.
• Biometric convenience: "Log in" with your face or fingerprint — nothing to type, nothing to remember.

As of 2026, passkeys are supported by Apple, Google, Microsoft, and most major sites (GitHub, Google, Apple ID, many banks and retailers). If a site offers a passkey option, use it. We're in the middle of the transition away from passwords — it will take years, but the direction is clear.

Have You Already Been Breached?

Check right now: haveibeenpwned.com — Troy Hunt's service aggregates billions of breach records. Enter your email address and it tells you which breaches it appeared in, what data was exposed, and when. It's free and safe to use.

If you appear in a breach:

1. Change the password on that site immediately (to a unique, manager-generated one).
2. Identify any other sites where you used the same or similar password. Change all of them.
3. Enable MFA on any of those accounts if you haven't already.
4. Check your email account specifically — if the breach exposed your email password, start there before anything else.

Also worth checking: haveibeenpwned.com/Passwords — you can check whether a specific password appears in any known breach corpus without the site ever seeing the full password (it uses a clever k-anonymity technique: only the first 5 characters of the SHA-1 hash of your password are sent to the server).

Security Questions: The Hidden Vulnerability

Security questions — "What's your mother's maiden name?" "What was your first car?" — are often easier to defeat than the password they're protecting. This information is frequently findable through social media, public records, or data brokers. Steve Gibson had his bank account compromised not through his password, but through his mother's maiden name, which he'd used as a reminder on another site.

Treat security question answers as additional passwords: use false, random, unique answers and store them in your password manager. "What was the name of your first pet?" — answer: correct-horse-battery-staple. The site has no idea and no way to verify. You know where the answer is stored.

Your Personal Password Policy

After all of the above, here's the practical policy that follows from the principles:

1. Get a password manager today. Bitwarden is free and excellent. 1Password is worth the $3/month. Either is fine. The best one is the one you'll actually use.
2. Set one strong master password. Apply the haystack principle: long, padded, memorable to you, all character types. 20+ characters. Memorize it. Write the scheme (not the password) somewhere safe.
3. Let the manager generate all other passwords. Random, 20+ characters, all character types. You'll never type them — the manager fills them. You don't need to know what they are.
4. Enable MFA on your email and password manager first. Use an authenticator app, not SMS if possible. Then work through your other critical accounts.
5. Check HaveIBeenPwned for your email addresses. Act on anything you find.
6. Migrate to passkeys wherever offered. Any site that offers a passkey option — use it.
7. Never reuse passwords. The manager makes this effortless. There is no excuse for reuse when the manager handles it.

Common Myths, Retired