Everything You Need to Know
About Passwords

History

A Brief History of Passwords

The concept of a secret word to verify identity is ancient — Roman soldiers used watchwords to identify friend from foe in the dark. But the computer password as we know it was born in 1961 at MIT, invented by Fernando Corbató for the Compatible Time-Sharing System (CTSS). Each user got their own files, and a simple password protected them.

Ironically, the very first known computer password theft happened almost immediately. A researcher printed out the entire password file to get extra computer time. Sound familiar? The fundamental problem — humans choosing, sharing, and mishandling passwords — has never changed.

Key milestones

• 1961 — First computer password, MIT CTSS
• 1979 — Unix introduces hashed passwords (passwords stored as encrypted values, not plain text)
• 1988 — Morris Worm uses dictionary attacks to crack Unix passwords — first major automated attack
• 2004 — Bill Gates predicts passwords will die within 10 years. He was wrong.
• 2009 — RockYou breach exposes 32 million passwords in plain text. “123456” tops the list.
• 2012 — LinkedIn breach: 117 million passwords leaked
• 2016 — Yahoo discloses breach of 3 billion accounts — the largest in history
• 2022 — FIDO2/Passkeys standard gains major adoption (Apple, Google, Microsoft)
• 2025 — Passkeys mainstream, yet “password123” remains in the top 10 most used passwords globally

Fundamentals

What Actually Makes a Password Strong?

Most people think a "strong" password means replacing letters with symbols: P@$$w0rd!. Security researchers have known for over a decade that this is almost useless. Why? Because attackers know it too. Every cracking dictionary includes thousands of these substitution patterns.

True password strength comes from exactly two things: length and genuine randomness. That's it.

Length is king

A 20-character random lowercase password (xkfmqbwdnrjztcpyhvse) is astronomically stronger than an 8-character "complex" password (P@$$w0rd). Here's why: every character you add multiplies the number of possible combinations by the size of the character set. With just lowercase letters (26 options):

• 8 characters: 26&sup8; = 208 billion combinations
• 16 characters: 26¹&sup6; = 43 quadrillion combinations (208 million times harder)
• 20 characters: 26²&sup0; = 19 sextillion combinations

Randomness is everything

The word "random" is key. Human-generated passwords are never truly random. We unconsciously follow patterns: we use words we know, dates that mean something, keyboard shapes (qwerty, zxcvbn), and predictable substitutions. Attackers exploit all of this.

A computer using crypto.getRandomValues() — the same method used by hPassword — produces output with no discernible pattern. It draws from hardware entropy sources: CPU thermal noise, mouse movements, disk timing. The result is genuinely unpredictable.

"The enemy knows the system." — Claude Shannon, 1949. Assume any pattern you use, attackers already know it and have it in their cracking lists.

The components of a strong password

Technical

Understanding Entropy (Without the Math Degree)

Security researchers measure password strength using a concept from information theory called entropy, measured in bits. Think of it as "how many yes/no questions would an attacker need to ask to guess your password?"

The formula: entropy = log&sub2;(charset_size) × length

For example, a 16-character password using all printable ASCII characters (94 options per character):

entropy = log&sub2;(94) × 16 ≈ 6.55 × 16 ≈ 105 bits

What does 105 bits mean in practice? At 10 billion guesses per second (a serious GPU attack), cracking this would take longer than the current age of the universe.

Entropy reference guide

Types

Types of Passwords and When to Use Each

Random character passwords

Example: Kf#9mL!2nQwE3$vR

The gold standard for security. Maximum entropy per character. Downside: impossible to memorize. Solution: don't try to memorize them — store them in a password manager. This is what you should use for 99% of your accounts.

Passphrases

Example: correct-horse-battery-staple

Made famous by the XKCD #936 comic strip. Four (or more) random dictionary words, separated by hyphens or spaces. High entropy due to length, easier to remember and type. Best for: your master password (the one you need to remember), or any password you must type regularly without a password manager.

PINs

Example: 847293

Only appropriate for physical devices with lockout mechanisms (phones, ATMs) where a failed attempt triggers a delay or lockout. Never use a PIN as a website password — there's no lockout to slow down an attacker.

What to avoid

• Passwords based on personal info — birthdays, pet names, hometowns. All searchable on social media.
• Keyboard patterns — qwerty, 123456, zxcvbn. First things attackers try.
• Word + number — password1, sunshine2023. Cracked in seconds.
• Leet speak substitutions — P@$$w0rd. Attackers have dictionaries for this.
• Dictionary words alone — even in other languages. Cracking tools are multilingual.

Mistakes

The Biggest Mistakes People Make

1. Password reuse

This is the single most dangerous password habit. In 2025, there are over 24 billion username/password combinations available on dark web markets. Attackers use credential stuffing: they take a leaked email/password pair and automatically try it on hundreds of other sites within minutes.

If you use the same password for your email and your bank, and any small website you've ever registered on gets breached, your bank account is now accessible to attackers. This happens every day.

2. Storing passwords insecurely

Common mistakes: a notes app on your phone, a text file on your desktop named "passwords.txt", a spreadsheet, Post-it notes, emailing passwords to yourself. Any of these can be accessed if your device is compromised or stolen.

3. Not using 2FA

Even a perfect password can be stolen through phishing. Two-factor authentication means the attacker also needs physical access to your phone or authenticator app. It's the single biggest security improvement most people can make today.

4. Using "security questions" as backup

Your mother's maiden name, the street you grew up on, your first pet's name — this information is often publicly available on social media, in genealogy databases, or through simple conversation. Security questions are authentication theater. Where possible, use a random string as the answer and store it in your password manager.

5. Ignoring breach notifications

When you receive an email saying a service has been breached, most people do nothing. The correct action: change the password immediately on that service, then check if you used the same password anywhere else and change it there too. Then visit haveibeenpwned.com to check your email.

Tools

Password Managers: Your Most Important Security Tool

A password manager is software that generates, stores, and autofills strong unique passwords for every site you use. You only need to remember one strong master password. Everything else is handled for you.

How they work

Your passwords are encrypted locally using strong cryptography (typically AES-256) before being stored or synced. Even the password manager company cannot read your passwords — they only have encrypted data that's useless without your master password. This is called zero-knowledge architecture.

Recommended options

• Bitwarden — Free, open-source, audited, works on all platforms. Best choice for most people.
• 1Password — Excellent design, family sharing features, paid subscription.
• KeePass — Free, open-source, stores data locally (no cloud). For technically confident users.
• Apple Keychain / Google Password Manager — Built into iOS/macOS and Android/Chrome. Convenient but ecosystem-locked.

What about browser password managers?

Browser-built-in password managers (Chrome, Firefox, Safari) are better than nothing, but they have limitations: they're tied to one browser, offer fewer security features, and may sync via accounts that could be compromised. A dedicated password manager is significantly more secure and feature-rich.

2FA

Two-Factor Authentication Explained

Two-factor authentication (2FA) requires you to provide two different types of evidence that you are who you say you are:

• Something you know — your password
• Something you have — your phone, hardware key, authenticator app

Types of 2FA, ranked by security

1. Hardware security keys (YubiKey, etc.) — Best. Physical device, phishing-resistant, immune to SIM swapping.
2. Authenticator apps (Google Authenticator, Authy) — Excellent. Time-based codes, not tied to your phone number.
3. Passkeys — Very good. Cryptographic, phishing-resistant, no shared secret.
4. Email OTP — Good. Only as secure as your email account.
5. SMS codes — Weak. Vulnerable to SIM swapping, where attackers convince your carrier to transfer your number to their SIM. Better than nothing, but use an authenticator app instead whenever possible.

By Use Case

Passwords for Specific Situations

📧 Your email account

Your email is the master key to your digital life. Every "forgot password" link gets sent to your email. If an attacker has your email, they can reset the password to your bank, social media, shopping sites — everything.

• Use your longest, most unique password
• Enable 2FA — ideally with an authenticator app
• Use a recovery email on a different provider
• Never share your email password with anyone for any reason

🏦 Banking and finance

A compromised bank account has immediate, real-world financial consequences.

• Unique strong password, never shared with any other site
• Enable every security alert (login notifications, transaction alerts)
• Enable 2FA if available
• Rotate every 6-12 months
• Never access banking from public Wi-Fi without a VPN

📱 Social media

Compromised social media accounts are used for fraud, blackmail, spreading misinformation, and accessing DMs that may contain sensitive personal information.

• Unique password for each platform (Facebook, Instagram, X/Twitter, LinkedIn, TikTok)
• Enable login alerts and 2FA
• Regularly audit third-party app connections — revoke any you don't actively use
• Be cautious with "Sign in with Google/Facebook" — it creates dependency

🌐 For webmasters and developers

Web professionals face unique password risks: managing credentials for dozens of client accounts, servers, databases, and services.

• Use a separate password for cPanel/Plesk, FTP/SFTP, database root, CMS admin, DNS registrar, and hosting control panels — never reuse across clients
• Enable IP whitelisting for SSH and admin panels where possible
• Use SSH keys instead of passwords for server access
• Rotate all credentials when a team member leaves
• Store client credentials in a team password manager (Bitwarden Teams, 1Password Business) — never in Slack, email, or shared documents
• WordPress admin: change the default admin username, use a strong password, limit login attempts
• Database credentials: never use root for application connections; create dedicated database users with minimum required privileges

🖥 Work accounts

A compromised work account can expose company data, client information, and internal systems. Many companies require specific password policies — follow them, but also apply your own good habits.

• Your work password should be as strong as your banking password
• Never use your work password anywhere else
• Report suspicious logins to your IT department immediately
• Be especially vigilant about phishing — corporate accounts are high-value targets

Emergency

What to Do When You've Been Hacked

Discovering your account has been compromised is stressful. Acting quickly and methodically is critical. Here's exactly what to do:

1. Change the compromised password immediately — from a clean device if possible
2. Check for reuse — did you use this password anywhere else? Change it there too
3. Enable 2FA on the compromised account if you haven't already
4. Check active sessions — most platforms let you see all logged-in devices and revoke them
5. Check account settings — look for changes to email address, phone number, recovery options, or forwarding rules
6. Scan for malware if you suspect your device was compromised
7. Check connected apps — revoke access to any third-party apps you don't recognize
8. Visit haveibeenpwned.com — check which services have been breached
9. Notify affected parties — if business data was involved, notify colleagues, clients, and relevant authorities
10. Document everything — dates, times, what was accessed, what you changed

Future

The Future: Passkeys and Beyond

The FIDO Alliance — a consortium including Apple, Google, and Microsoft — has developed passkeys, designed to eventually replace passwords entirely.

How passkeys work

Instead of a password, your device creates a pair of cryptographic keys: a public key stored on the website's server, and a private key stored only on your device. When you log in, the website sends a challenge that only your private key can sign. Your device unlocks the private key using your fingerprint, face, or PIN — and you're in. No password is ever transmitted or stored on the server.

Why passkeys are better

• Phishing-resistant — the key only works on the exact domain it was created for
• Nothing to steal — no shared secret stored on servers, so server breaches can't expose credentials
• No reuse possible — each passkey is unique to a site by design
• No passwords to remember — your biometrics or device PIN is the only thing needed

Are passwords dying?

Not immediately. Passkey adoption is growing rapidly, but it will take years for all services to support them. Password managers and strong password hygiene will remain essential for the foreseeable future. The best strategy today: use passkeys where available, strong unique passwords everywhere else.

Quantum computing and passwords

Much-discussed but still largely theoretical for password cracking. Quantum computers could theoretically break asymmetric encryption (RSA, ECC) much faster, but classical brute-force attacks on passwords would only be modestly faster — roughly halving the effective security bits. A 256-bit password would still be effectively secure against quantum attacks. For now, focus on good password hygiene; quantum threats are not the most pressing concern for average users.

Quick Reference

Quick Reference Checklist

Bookmark this. Use it as a security audit for your accounts.