Password Security Guide:
Protect Your Digital Life

1. Why Password Security Matters

Passwords are the keys to your digital life. A single compromised password can lead to:

• Identity theft: Access to email enables password resets for other accounts
• Financial loss: Banking, PayPal, crypto wallets compromised
• Reputation damage: Social media hijacking, impersonation
• Data breaches: Work accounts expose company data
• Cascading failures: One breach leads to many via password reuse

2. Anatomy of a Strong Password

Password Strength Examples:

3. Understanding Password Entropy

Entropy measures the randomness (unpredictability) of a password in bits. Higher entropy = harder to guess. It's the true measure of password strength.

Character Pool Sizes:

• Lowercase only (a-z): 26 characters → 4.7 bits per character
• + Uppercase (A-Z): 52 characters → 5.7 bits per character
• + Numbers (0-9): 62 characters → 5.95 bits per character
• + Symbols (~33): 95 characters → 6.57 bits per character

Entropy Examples:

4. Common Password Attacks

5. Password Managers

How Password Managers Work:

1. Generate strong, unique passwords for each account
2. Store all passwords in an encrypted vault
3. Vault is encrypted with your master password (never stored)
4. Autofill credentials on websites and apps
5. Sync across devices securely

Popular Password Managers:

Master Password Requirements:

Your master password is the only one you need to remember. Make it strong:

• At least 16 characters (ideally 20+)
• Use a memorable passphrase: "correct-horse-battery-staple-42!"
• Never reuse it anywhere else
• Consider writing it down and storing securely (safety deposit box)

6. Two-Factor Authentication (2FA)

2FA adds a second layer of security. Even if your password is stolen, attackers can't access your account without the second factor.

Types of 2FA (Best to Worst):

Enable 2FA on These First:

1. Email accounts - Gateway to all other password resets
2. Password manager - Keys to the kingdom
3. Banking & financial - Direct financial impact
4. Social media - Reputation and identity
5. Cloud storage - Sensitive documents

7. Passphrases vs Passwords

A passphrase is a password made of multiple random words. They can be more secure AND easier to remember than complex passwords.

Passphrase Best Practices:

• Use 4-6 random words from a large wordlist (7000+ words)
• Don't pick words yourself - Use a generator (humans are bad at random)
• Add variations for more entropy: numbers, capitals, separators
• Never use famous phrases: song lyrics, book quotes, etc.

Passphrase Entropy by Word Count:

8. Storing Passwords (For Developers)

Password Storage Hierarchy:

1. Argon2id - Winner of Password Hashing Competition, memory-hard
2. bcrypt - Battle-tested, widely available, CPU-hard
3. scrypt - Memory-hard, good alternative
4. PBKDF2 - Acceptable for compliance, configure high iterations
5. ❌ SHA-256/MD5 - Never use for passwords (too fast)

Implementation Example (Node.js):

const bcrypt = require('bcrypt');

// Hash a password (during registration)
async function hashPassword(plaintext) {
    const saltRounds = 12; // Cost factor - higher = slower = more secure
    return await bcrypt.hash(plaintext, saltRounds);
}

// Verify a password (during login)
async function verifyPassword(plaintext, hash) {
    return await bcrypt.compare(plaintext, hash);
}

// Usage
const hash = await hashPassword('user-password');
// Store hash in database: $2b$12$LQv3c1yqBW...

const isValid = await verifyPassword('user-password', hash);
// Returns true if password matches

See our Hash Functions Guide for detailed information on password hashing algorithms.

9. Password Security Checklist

10. Frequently Asked Questions