Question 1

How long should a secure password be in 2026?

Accepted Answer

NIST Special Publication 800-63B Digital Identity Guidelines (Rev. 3, June 2017, with Rev. 4 draft released August 2024) recommends a minimum of 8 characters for user-chosen memorized secrets and encourages passwords of 15+ characters when generated randomly. NIST §5.1.1.2 requires systems to accept passwords up to at least 64 characters. The classical entropy calculation (Shannon 1948; NIST SP 800-63B Appendix A) is bits = length × log2(alphabet_size). For a fully random 12-character password from the 94-character printable ASCII set: 12 × log2(94) ≈ 78.7 bits — sufficient to withstand offline brute-force against a properly-hashed store (Argon2id, bcrypt cost ≥12, or PBKDF2 with ≥600,000 iterations per OWASP Password Storage Cheat Sheet 2024). Cracking benchmarks published annually by Hashcat and reflected in Krebs on Security estimate that offline attacks against unsalted MD5 can process 200+ billion guesses/sec on an 8×RTX 4090 rig, making 78+ bit passwords secure against foreseeable brute-force horizons.

Question 2

Should a password mix letters, numbers, and symbols?

Accepted Answer

NIST SP 800-63B §5.1.1.2 explicitly recommends AGAINST composition rules ('must contain 1 uppercase, 1 number, 1 symbol') because they push users toward predictable patterns (Password1!, Summer2024!) that reduce actual entropy. The current NIST guidance instead recommends: (1) minimum length ≥8 (users) or ≥15 (system-generated); (2) blocklist checking against known-compromised passwords per §5.1.1.2 (integrate the HIBP 'k-anonymity' API from Have I Been Pwned per Troy Hunt's Pwned Passwords service releases through 2024); (3) allow all printable ASCII and Unicode characters up to 64 characters; (4) no periodic rotation absent evidence of compromise (§5.1.1.2); (5) no hints or knowledge-based recovery questions (§5.1.1.2). A fully random 15-character password from the 94-char set has ~98 bits of entropy — significantly stronger than a 12-character password that mixes 'complexity' but reuses a common structure.

Question 3

Are password managers safer than remembering passwords?

Accepted Answer

Yes, for the overwhelming majority of users, per NIST SP 800-63B §5.1.1.2 (explicitly permits and encourages password managers), CISA's Cybersecurity Best Practices guidance (updated 2024), and FTC consumer guidance at consumer.ftc.gov/articles/password-checklist. A reputable password manager (1Password, Bitwarden, KeePass) generates cryptographically random passwords 20+ characters long per site, encrypts the vault with AES-256 GCM under a master password stretched via Argon2id (Bitwarden 2023 default) or PBKDF2 with 600,000+ iterations (1Password), and provides zero-knowledge sync — the vendor cannot decrypt the vault. The threat model shifts from 'password reuse across sites' (the single largest breach-multiplier per Verizon Data Breach Investigations Report 2024) to 'master password strength + local-device security.' Vault breaches historically (LastPass 2022 per Karim Toubba's blog posts August-November 2022) exposed vault backups but not decrypted contents. Use a strong master password (15+ random characters or a 6+ word Diceware passphrase per Reinhold's 1995 EFF Diceware list), enable multi-factor authentication on the vault, and keep the vault client updated.

Question 4

What is a passphrase and is it better than a password?

Accepted Answer

A passphrase is a memorized secret constructed from multiple random words rather than a single 'word' — for example 'correct-horse-battery-staple' (xkcd 936, 2011) or 'orbit-drift-mineral-vault-cascade' (5 words). The security depends on the wordlist and the number of words: a 6-word Diceware passphrase drawn from the EFF Large Wordlist (7,776 words, published 2016) has 6 × log2(7,776) ≈ 77.5 bits of entropy — comparable to a 12-character random ASCII password. NIST SP 800-63B §5.1.1.2 explicitly allows and encourages passphrase composition subject to the minimum length rule. Advantages: much easier to memorize and type accurately than random-character strings, less shoulder-surfing risk than complex passwords, no per-service reuse if paired with a password manager for less-critical sites. Disadvantages: users tend to underestimate entropy loss from grammatical/semantic patterns and word choice (e.g., common-word top-1000 lists reduce entropy). Random selection (a physical dice roll or getrandbits from Python's secrets module per PEP 506) matters more than the wordlist size.

Question 5

What are the top compromised passwords to avoid?

Accepted Answer

The annual 'Worst Passwords' lists compiled by NordPass (2024 release, drawing from 4.3 TB of breach data via Independent Advisors) and SplashData (2011-2019 releases) consistently identify the same top compromised strings: 123456, password, 123456789, qwerty, 12345678, 111111, 1234567890, 1234567, admin, letmein. The Have I Been Pwned Pwned Passwords database (Troy Hunt, hosted at haveibeenpwned.com/Passwords) contains over 850 million SHA-1 hashes of passwords that have appeared in known breaches; NIST SP 800-63B §5.1.1.2 recommends checking user-chosen passwords against such a blocklist. Never use: (1) any word in a dictionary (English, Spanish, or names); (2) sequential characters (qwerty, asdf, 123); (3) personal information (birthdate, family names, favorite team, license plate); (4) the same password on any two sites — reuse converts every breach into a credential-stuffing attack against every other site you use (Verizon DBIR 2024 attributes 61% of hacking breaches to stolen credentials or brute-force).

Password Generator