Password Security

Password security is the practice of creating, managing, and protecting authentication credentials to prevent unauthorized account access. It requires using cryptographically random passwords of sufficient length (16+ characters), storing them in an encrypted password manager, and layering multi-factor authentication as a second defense.

NIST Special Publication 800-63B recommends a minimum of 8 characters, but security researchers recommend 16-20 characters for strong protection. Length adds entropy multiplicatively: a 20-character lowercase password has more entropy than an 8-character password with mixed symbols. Passphrases of 4-6 random words typically provide 50-80 bits of entropy.

Never. When a service is breached, attackers automatically test leaked email-password pairs against hundreds of other websites (credential stuffing). A single reused password can expose your email, banking, and social media accounts simultaneously. A password manager eliminates reuse by generating unique passwords for every account.

The best password manager is one you will actually use consistently. Top options include Bitwarden (open-source, free tier, audited), 1Password (polished interface, family plans, Travel Mode), and KeePass (fully offline, local storage). All three use zero-knowledge encryption — the provider cannot access your vault.

Use the Have I Been Pwned API, which compares a SHA-1 hash prefix of your password against billions of leaked credentials using k-anonymity — your actual password never leaves your device. GeneratePass also offers a client-side breach checker that performs the same comparison entirely in your browser.

Quality checkers that calculate Shannon information entropy and check against dictionary attack patterns are highly accurate at estimating brute-force crack times. However, they cannot detect contextual weaknesses like using a pet's name or a birthdate. Always combine entropy-based checking with truly random generation.

Four criteria: sufficient length (16+ characters), genuine randomness from a cryptographic generator (not human-chosen), absolute uniqueness across all accounts, and secure storage in an encrypted password manager rather than memory, sticky notes, or plain text files.