Strong passwords today: from long phrases to passkeys

Passwords do not get cracked the way movies show. Nobody sits guessing your dog's name: passwords leak from hacked services by the million and then get tested automatically on all other sites. This machine mechanics dictates the real protection rules, which differ noticeably from the usual "eight characters with an asterisk" of old guides. Let's lay them out in order, from the properties of the password itself to life without one.

What really matters

Two properties decide everything. Uniqueness: one password per service, because otherwise a leak at any site opens your entire life; trying leaked login-password pairs on other services is the main method of mass hacking. Length: resistance to machine cracking grows with each character faster than from any tricks, and a phrase of four random words beats a short gibberish string with special symbols. Everything else, from regular changes with no reason to replacing letters with digits, belongs to a past era: change a password after a leak, ignore the calendar.

A password manager changes the rules

The requirement of "a hundred long unique passwords" is impossible for a head and trivial for a manager: it generates, stores and fills passwords itself, leaving you one master phrase. Take any mature tool: the one built into your system and browser is already good and free, and separate apps add convenience when you live on several platforms at once. Two operating rules: the master phrase is long and used nowhere else, and a second factor guards entry to the manager itself. An underrated bonus: a manager fills a password only on the real domain and stays silent on a fake one, which turns it into a phishing detector, as we wrote in the article on phishing.

A second factor is mandatory

Whatever your password is, it may one day leak from the service itself. A second factor makes a leaked password useless: entry also requires confirmation from your device. The strength hierarchy is simple: SMS codes beat nothing, an authenticator app clearly beats SMS, and a hardware key or a device's built-in biometrics are strongest. Enable it at least on mail, banks and main social networks: mail matters most on this list, because all other passwords get recovered through it. We go through the options in detail in the article on two-factor authentication.

For most people the choice of second factor looks like this: an authenticator app on the phone for everything important, a hardware key for mail and finance if you are willing to carry one, SMS where nothing else is offered. And be sure to save backup codes when enabling it: phones get lost along with their authenticators, and recovery without codes turns into a quest with a passport and support.

Passkeys: life after passwords

Large platforms already offer sign-in with no password at all: a passkey is a cryptographic key that lives on your device and works with biometrics or a PIN. There is nothing to guess, nothing to leak from a server, and on a fake site the key simply will not work, because it is tied to the real domain. The same ecosystems and password managers handle sync between devices. The strategy for today: enable a passkey wherever offered, while the password stays as a backup entry, so its hygiene still matters.

Where to write things down and what to leave out

Three things never get stored in the open: the manager's master phrase, card PINs and backup codes in unencrypted phone notes. Paper at home, paradoxical as it sounds, is a decent place for a master phrase and backup codes: threats from the internet do not reach a desk drawer. A "passwords.txt" file on the desktop and an unencrypted cloud spreadsheet, though, are gifts to a future thief: malware on an infected machine looks for them first.

A plan for the evening

1. Install a manager and come up with one long master phrase.
2. Change the passwords on mail and your bank to generated ones, enable a second factor there and passkeys where available.
3. Then change passwords as you visit services: within a month, most of them are unique.
4. Save backup recovery codes in the same place, in the manager or on paper at home.
5. Check your mail against leak databases, a check built into modern managers and browsers: passwords found there get changed first.

That closes the topic for years ahead: the manager handles uniqueness, length handles resistance, a second factor devalues password theft, and passkeys gradually remove the thing being stolen. If an account already behaves strangely, skip the passwords and start with the steps to take after a hack.