Password security that actually helps

Password advice aged badly because it optimised the wrong variable. Composition rules—one uppercase, one digit, one symbol—produce predictable mangling like "Summer2024!", which sits in every cracking wordlist. Entropy grows linearly with length and only logarithmically with alphabet size, so extra characters help far more than extra rules.

What a strength meter can and cannot see

A local estimator scores length, character variety, and obvious patterns. It cannot know whether your password appeared in a breach corpus, which is the single most useful signal. Treat a green meter as a floor, not a verdict.

Generated secrets need a home

A sixteen-character random string is only useful if you never have to remember it. Copy it straight into a password manager, and prefer a multi-word passphrase for the handful of secrets you must type on a device without one.

What matters more than the password

Multi-factor authentication defeats most credential stuffing regardless of password quality. Unique passwords per site limit blast radius when a service is breached. Both are worth more than a symbol quota.

For anyone storing passwords

Never store a password reversibly and never store a fast hash of one. Use a salted, memory-hard function with a tuned work factor, and treat the digest as sensitive even after hashing.

Generate and check locally

Create secrets with Password Generator, review candidates with Password Strength Checker, and read Password Length vs Complexity for the trade-off in detail.