# passwordstrength.net — Full Site Content (for AI systems) This file contains the full text content of passwordstrength.net, formatted as markdown, for use by AI systems, LLMs, and research tools. It is generated from the live site and mirrors the visible page content (tool descriptions, FAQ answers, glossary definitions, and full article text). For a curated, shorter index instead, see https://passwordstrength.net/llms.txt --- ## PAGE: PasswordStrength.net URL: https://passwordstrength.net/ Summary: Free password strength checker and secure password generator. Powered by zxcvbn — real attack modeling, not just character counting. 100% private, runs entirely in your browser. ### Realistic Estimation We use the zxcvbn library developed by Dropbox, which analyzes real-world attack patterns, dictionary words, and common substitutions — not just character counts. We also flag an instant, exact match against the 10,000 most commonly breached passwords, entirely offline. ### 100% Private Analysis and generation happen entirely in your browser — your password is never transmitted, stored, or logged. The optional breach check sends only a partial hash, never your actual password. ### Instant Analysis Real-time strength feedback as you type. Covers offline dictionary attacks, brute-force scenarios, and pattern recognition simultaneously. --- ## PAGE: Free Password Strength Checker URL: https://passwordstrength.net/passwordstrengthchecker.html Summary: Test your password strength instantly. Powered by zxcvbn — real attack modeling, 100% private, runs in your browser. ### Realistic Estimation We use the zxcvbn library developed by Dropbox, which analyzes real-world attack patterns, dictionary words, and common substitutions — not just character counts. We also flag an instant, exact match against the 10,000 most commonly breached passwords, entirely offline. ### 100% Private Strength analysis happens entirely in your browser — your password is never transmitted, stored, or logged. The optional breach check sends only a partial hash, never your actual password. ### Instant Analysis Real-time strength feedback as you type. Covers offline dictionary attacks, brute-force scenarios, and pattern recognition simultaneously. ## Why character-counting gets this wrong Traditional strength meters count uppercase letters, digits, and symbols and reward you for adding a "!" or capitalizing a letter — which is how P@ssw0rd! scores as "strong" on so many sites despite being one of the first passwords any real attacker tries. This checker uses zxcvbn instead, which models how attacks actually work: dictionary words, names, keyboard walks, and leet-speak substitutions are matched as patterns first, and only the unpredictable part left over gets counted toward your entropy. That's also why length matters more than character variety. Per NIST SP 800-63B-4 (see Sources below), 15+ characters from a large, non-obvious pool beats 8 characters with a "required" symbol and digit — the crack-time estimates above are shown across four realistic attack scenarios, from a throttled online login to an offline fast hash, rather than one generic number, because the honest answer to "how long would this take to crack" always depends on how the password is stored on the other end. ## Where this tool's guidance comes from This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source. --- ## PAGE: Free Password Generator URL: https://passwordstrength.net/passwordgenerator.html Summary: Generate strong, random passwords and passphrases instantly. Customizable, 100% private, runs entirely in your browser. ### Realistic Estimation We use the zxcvbn library developed by Dropbox, which analyzes real-world attack patterns, dictionary words, and common substitutions — not just character counts. ### 100% Private Generation happens entirely in your browser — your password is never transmitted, stored, or logged. The optional breach check sends only a partial hash, never your actual password. ### Instant Analysis Real-time strength feedback as you type. Covers offline dictionary attacks, brute-force scenarios, and pattern recognition simultaneously. ## Why this generator defaults to length over complexity Every password below is built from a cryptographically secure random number generator (CSPRNG) — the same class of randomness required for cryptographic keys, not the simpler pseudo-random functions used for things like shuffling a deck of cards in a game. That distinction matters: a "random-looking" password from a weak RNG can sometimes be predicted by anyone who figures out the underlying algorithm and its seed. A CSPRNG can't be, even in principle. The defaults favor length over forced complexity, matching NIST SP 800-63B-4's current guidance (see Sources below): a 16+ character password from a full character set is dramatically harder to crack than an 8-character one stuffed with a mandatory symbol and digit — and it's usually easier to type correctly, too. Passphrase mode goes a step further, building from the EFF's Diceware wordlist — each word adds about 12.9 bits of entropy, so a five-word passphrase already beats most "complex" 12-character passwords while staying genuinely memorable. ## Where this tool's guidance comes from This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source. --- ## PAGE: Bulk Password Audit Tool URL: https://passwordstrength.net/bulk-password-audit.html Summary: Paste or upload a list of passwords for an instant strength audit — zxcvbn scoring, common-password matches, and an optional breach check. 100% private. One password per line, or a CSV with a password column (an optional username column is picked up automatically). Analysis runs the moment you click Analyze — nothing is uploaded anywhere. ## How this stays private ## Where this tool's guidance comes from This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source. --- ## PAGE: PIN Strength Checker URL: https://passwordstrength.net/pin-strength-checker.html Summary: Check whether your 4–6 digit PIN is common or follows a predictable pattern like a birth year or keypad shape. Private, instant, in your browser. ## PINs aren't just short passwords ## Where this tool's guidance comes from This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source. --- ## PAGE: PIN Generator URL: https://passwordstrength.net/pin-generator.html Summary: Generate a random PIN that's never a common PIN, a keypad shape, a date, or a repeat. Pick 4, 5, 6, or 8 digits. Private, instant, in your browser. ## Random digits alone aren't enough ## Where this tool's guidance comes from This tool's defaults and pattern-avoidance rules are built on the following official, internationally recognized standards and public research — not opinion. Each link goes directly to the source. --- ## PAGE: WiFi Password Generator URL: https://passwordstrength.net/wifi-password-generator.html Summary: Generate a strong WiFi router password sized for WPA2/WPA3, with a scannable QR code for instant guest access. 100% private, in your browser. WPA2/WPA3-Personal accepts an 8–63 character password. We default to settings that are strong, but also easy to type on a TV remote or read off a printed card — tweak freely. ### Sized for WPA2/WPA3 Defaults to 20 characters, well within the 8–63 character range every WPA2/WPA3-Personal router accepts, with ambiguous characters (0/O, l/I) excluded so it's easy to read off a printed card. ### Scannable QR Code Add your network name and get a QR code guests can scan to join instantly — no typos, no reading a password aloud across the room. Generated entirely in your browser. ### 100% Private Generation and the QR code happen entirely in your browser — your password and network name are never transmitted, stored, or logged. The optional breach check sends only a partial hash, never the password itself. ## Why your WiFi password isn't just "a password" A WiFi pre-shared key (PSK) plays by different rules than a website password. It's used during the WPA2/WPA3 4-way handshake, which is designed so the key itself never crosses the air in the clear — but that handshake can be captured and attacked offline at leisure, so the key still needs to be long and random rather than memorable. This generator defaults to a length that stays comfortably out of reach of any practical offline attack. If your router supports WPA3, use it — its SAE key exchange (see Sources below) closes the offline dictionary-attack weakness that WPA2's handshake has always had, by requiring an attacker to interact with the access point for every single guess instead of cracking a captured handshake in isolation. Either way, put guests and smart-home devices on a separate guest network rather than sharing your main WiFi password with them — it's the single biggest practical upgrade most home networks are still missing. ## Where this tool's guidance comes from This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source. --- ## PAGE: 2FA / TOTP QR Code Generator URL: https://passwordstrength.net/two-factor-qr-generator.html Summary: Create a standards-based TOTP 2FA secret and scan it into Google Authenticator, Authy, or any app — with a live code to confirm it works. Create a standard TOTP secret and get a QR code to scan into your authenticator app. The secret, QR code, and live code are all generated and verified entirely in your browser — never sent anywhere. ### Standard TOTP (RFC 6238) Uses the same SHA-1-based algorithm as Google Authenticator, Authy, and every major authenticator app — the code generated here will match what your phone shows. ### Instant QR Setup Scan the generated QR code directly into your authenticator app instead of typing a long secret by hand — drawn entirely client-side with no external requests. ### 100% Private Secret generation, QR rendering, and code computation all happen in your browser using the Web Crypto API. Nothing is transmitted, stored, or logged — closing the tab discards everything. ## What's actually happening when you scan this code TOTP doesn't send a code anywhere to be checked. Your authenticator app and the service you're logging into both already hold the same secret key — the one this tool generates and encodes into the QR code — and each independently combines that key with the current time, in 30-second steps, through an HMAC-SHA1 hash to arrive at the same 6-digit code. That's why it still works with your phone in airplane mode: no network round-trip is needed, just a synchronized clock (see RFC 6238 in Sources below). It's also why the shared secret deserves the same protection as a password: anyone who scans your QR code or copies your setup key can generate valid codes for your account indefinitely, exactly as if they'd stolen your password. Save the backup/recovery codes your service offers when you turn on 2FA, and never send your QR code or secret to anyone who asks for it — a real support agent will never need it. ## Where this tool's guidance comes from This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source. --- ## PAGE: Batch Password Generator URL: https://passwordstrength.net/batch-password-generator.html Summary: Generate a batch of strong random passwords or passphrases at once, then copy or download the list as a .txt file. 100% private. ### Pick a Favorite Generate 5 to 50 candidates at once, each with its own zxcvbn strength badge, so you can choose one you like instead of re-rolling a single password repeatedly. ### 100% Private Every password is generated entirely in your browser using the same engine as our single-password generator — nothing is transmitted, stored, or logged. ### Copy or Export Copy any single password, copy the whole batch to your clipboard at once, or download the list as a plain .txt file. ## Why batch-generated passwords need extra care Generating fifty passwords at once creates a different risk than generating one: how those fifty passwords get from this screen into fifty actual accounts. Each one below is generated independently by the same CSPRNG used throughout this site — none are derived from each other or follow a shared pattern, which matters because a predictable sequence (an incrementing counter, a shared base word) can let a single leaked password compromise the rest of the batch. The bigger real-world risk is usually distribution, not generation: pasting a batch into an unencrypted spreadsheet, emailing it in plain text, or leaving it sitting in chat history. If you're provisioning accounts for other people, send each password through a channel they'll only see once — a password manager's secure-share feature, not email — and require a reset on first login wherever the system supports it. ## Where this tool's guidance comes from This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source. --- ## PAGE: Password Policy Compliance Checker URL: https://passwordstrength.net/password-policy-checker.html Summary: Define your own password policy — length, character types, banned words — and check passwords against it, one at a time or in bulk. ## Check a whole list against this policy One password per line, or a CSV with a password column (an optional username column is picked up automatically). Uses the policy defined above — change it any time and re-run. ## How this stays private ## Where this tool's guidance comes from This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source. --- ## PAGE: Free Online Tools URL: https://passwordstrength.net/tools.html Summary: A collection of free online tools for everyday tasks — calculators, encoders, decoders and more. All tools run in your browser. ### Password Strength Checker Real-time strength analysis powered by zxcvbn, plus a common-password blocklist and an optional breach check — all running locally in your browser. ### Password Generator Generate random passwords or Diceware-style passphrases (7,776-word EFF wordlist) with full control over length and character sets. ### Bulk Password Audit Paste or upload a list of passwords and get an instant strength report for all of them at once — built for IT admins and team password audits. ### PIN Strength Checker Check your 4–8 digit PIN against common PINs, keypad shapes, dates, and other predictable patterns attackers try first. ### WiFi Password Generator Generate a router password sized for WPA2/WPA3, with a scannable join QR code for guests — no typing required. ### 2FA / TOTP QR Generator Create a standard TOTP secret and scan it into Google Authenticator, Authy, or any app — with a live code to confirm it works. ### Batch Password Generator Generate 5 to 50 passwords at once, each with a strength badge, so you can pick a favorite instead of re-rolling one at a time. ### Policy Compliance Checker Define your own password policy — length, character rules, banned words — and check a single password or a whole list against it. ### Square Footage Calculator Instantly calculate the square footage of any room, floor, wall, or space. Perfect for home renovation, flooring, painting, and building projects. ### Percentage Calculator Calculate percentages instantly — find what percent one number is of another, calculate percentage increase or decrease, and more. ### Age Calculator Calculate your exact age in years, months, and days from your date of birth. Also find the difference between any two dates. ### Hours Calculator Add up work hours and minutes between times, build weekly timesheets, and compute overtime pay across 50+ time zones. ### Margin vs Markup Convert between profit margin and markup, find break-even, and factor in platform fees, shipping, and tax. ### Dimensional Weight Calculator Work out billable shipping weight for FedEx, UPS, USPS, DHL and more carriers, comparing actual vs volumetric weight. ### Box Volume Calculator Calculate the volume of a box from its length, width, and height in any units — for shipping, storage, and packing. ### Girth Calculator Parcel length-plus-girth against carrier size limits, plus body circumference measurements for fitness tracking. ### Unit Cheat Sheet Engineering and scientific unit converter with printable reference tables — wire gauges, drill bits, pipe sizes, and more. ### Solar Calculator Free, unbiased solar and off-grid calculators — system sizing, savings and payback, and battery banks. ### EMI Calculator Calculate EMIs for home, car, and personal loans in India. See total interest, principal breakdown, and a full amortization schedule. ### Voltage Drop Calculator Calculate voltage drop across wire runs by gauge, length, and current. Check against NEC limits for safe electrical installations. ### Calorie Calculator Estimate daily calorie needs, TDEE, and macros from your age, weight, height, and activity level for weight loss or gain. ### Total Interest Calculator See the total interest you'll pay over the life of any loan, with monthly payments and a complete amortization breakdown. ### AC Tonnage Calculator Size an air conditioner for any room by square footage, climate, and sun exposure to find the right cooling capacity in tons. ### Tank Volume Calculator Calculate the volume and fill level of cylindrical, rectangular, and oval tanks in gallons, liters, and more. ### Cubic Yardage Calculator Work out cubic yards of concrete, gravel, mulch, or soil for landscaping and construction projects. ### BMI & BMR Calculator Calculate your Body Mass Index and Basal Metabolic Rate, plus daily calorie needs based on your activity level. ### Solar Battery Bank Calculator Size an off-grid battery bank from your daily energy use, days of autonomy, and depth of discharge. ### Fraction Calculator Add, subtract, multiply, and divide fractions with clear step-by-step working and simplified results. ### Backup Power Calculator Size a generator or UPS by adding up appliance wattage and runtime for home and office backup power. ### Stair Calculator Calculate stair rise, run, stringer length, and number of steps to build code-compliant staircases. ### Concrete Material Calculator Estimate concrete, cement, sand, and aggregate quantities for slabs, footings, columns, and walls. ### SIP Calculator Project the future value of your mutual fund SIP investments with expected returns and step-up options. ### Roofing Material Calculator Estimate shingles, underlayment, and materials needed for any roof by area, pitch, and waste factor. ### GPA Calculator Calculate your GPA and CGPA from course grades and credit hours, with weighted and unweighted options. ### Construction Calculator A suite of construction math tools — feet-and-inches, area, volume, and material estimates for job sites. ### Pool Volume Calculator Calculate the water volume of rectangular, round, and oval pools in gallons and liters for dosing and heating. ### Base64 Decoder Decode any Base64-encoded string back to plain text instantly. Supports standard Base64, URL-safe Base64, and file decoding — all in your browser. ### Base64 Encoder Encode any text, file, or data into Base64 format. Used by developers for encoding data in APIs, emails, HTML, and configuration files. ### URL Encode & Decode Encode special characters in URLs to make them safe for web use, or decode URL-encoded strings back to readable text. Essential for web developers. ### JSON Tools Format, validate, minify, and convert JSON in your browser. Pretty-print messy JSON, spot syntax errors with line numbers, and switch between JSON, YAML, CSV, and XML. ### Hash Generator Generate MD5, SHA-1, SHA-256, SHA-512 and other cryptographic hashes from any text or file. Useful for integrity checks, password hashing demos, and developer testing. ### UUID Generator Generate UUID v1, v4, and v7 identifiers in bulk for use in databases, APIs, distributed systems, and testing. Copy single UUIDs or batches with one click. ### Word Counter Count words, characters, sentences, paragraphs, and reading time as you type. Useful for essays, blog posts, social media captions, and SEO content. ### Epoch Time Converter Convert between Unix epoch timestamps and human-readable dates. Supports seconds, milliseconds, and time zones. ### Crontab Sheet Build and decode cron expressions with plain-English explanations and the next run times for any schedule. ### Regex Guide Build, test, and debug regular expressions with token-by-token explanations, a pattern library, and code in 7 languages. ### CIDR Calculator Calculate, split, and visualize subnets. IPv4/IPv6, VLSM planner, cloud-aware reserved IPs, and Terraform export. ### Subnet Mask Calculator Network and broadcast addresses, usable host range, wildcard masks, and VLSM planning for IPv4 and IPv6. ### Text Repeater Repeat any word, phrase, or emoji up to 100,000 times with custom separators and optional numbering. ### Case Transformer Convert text between Title Case, sentence case, camelCase, snake_case, kebab-case, and more, with side-by-side preview. ### Picture Toolkit Browser-based image tools — compress, convert, resize, crop, and watermark. Files never leave your device. ### Remove Metadata Strip EXIF, GPS, and hidden metadata from images, PDFs, and Office files — locally in your browser. ### Clock With Us Online alarm clock, timer, stopwatch, and world clock that runs in your browser. Alarms ring even in a background tab. ### PDF Tools Merge, split, compress, convert, and edit PDF files right in your browser — nothing is uploaded to a server. ### Color Code Kit Convert colors between HEX, RGB, HSL, and more, build palettes, and check contrast for accessible design. ### Barcode & QR Generator Create QR codes and barcodes for URLs, text, Wi-Fi, and products, then download them as PNG or SVG. ### Cooking Converter Convert cooking measurements between cups, grams, ounces, and milliliters for accurate recipes. ### Number to Words Convert numbers into written words and currency amounts for checks, invoices, and legal documents. ### Internet Speed Test Test your download, upload, and ping speeds right in the browser with an accurate, ad-light speed test. ### IP Address Checker Instantly see your public IP address, location, ISP, and browser details — IPv4 and IPv6 supported. ### WHOIS Lookup Look up domain registration, ownership, expiry dates, and DNS records with a fast WHOIS lookup tool. ## Don't forget your password security Use our free password checker and generator — no account needed, nothing ever leaves your browser. --- ## PAGE: How It Works URL: https://passwordstrength.net/how-it-works.html Summary: Learn how our password strength checker uses the zxcvbn engine — real attack modeling, entropy calculation, and crack time estimation explained in plain English. ### Your password stays in your browser The very first thing to understand: your password is never sent anywhere. All analysis runs via JavaScript in your browser tab. There is no server-side call, no network request, no logging. You can even disconnect from the internet and the checker will still work. ### zxcvbn breaks the password into patterns The zxcvbn library (open-sourced by Dropbox) tokenizes your password into segments. It looks for dictionary words, names, common substitutions (like @ for a ), keyboard walk patterns (like qwerty ), date sequences, and more. Each segment is scored independently. ### Guesses required is calculated For each segment, zxcvbn estimates how many guesses an attacker would need to find it. These are combined to give a total "guesses" figure. This is far more meaningful than simple character-type counting, because it reflects how real attacks actually work — dictionary attacks come before brute force. ### Crack time is estimated per scenario The guesses figure is divided by different hardware speeds: throttled online attacks (~100/hr), unthrottled online (~10/sec), offline slow hashing (~10,000/sec, like bcrypt), and offline fast hashing (~10 billion/sec, like MD5/SHA1). This gives you four realistic time-to-crack numbers. ### Score 0–4 and suggestions are generated zxcvbn maps the guesses to a score from 0 (too guessable) to 4 (very unguessable). It also generates human-readable feedback — for example, warning you that "hunter2" is a common password or suggesting you add more random characters. We display all of this in real-time as you type. ### The old way: character counting Traditional meters give points for uppercase letters, numbers, and special characters. This leads to absurd results — P@ssw0rd! scores as "strong" on most meters despite being one of the first passwords attackers try. It measures complexity, not security. ### The zxcvbn way: pattern matching zxcvbn uses a corpus of millions of real-world passwords, names, common words, and keyboard patterns to estimate how many guesses an attacker would need. P@ssw0rd! gets a score of 0 because it matches known patterns, regardless of the character types used. ### Massive dictionaries built in The library includes the 10,000 most common English words, 10,000 common passwords from breach data, first and last names, US cities, English Wikipedia terms, and TV/movie words. These are compressed and shipped with the library — no server needed. ### Leet-speak & keyboard walks detected Substituting 3 for e , @ for a , or 0 for o adds almost no security. zxcvbn models these transformations and adjusts the guess count accordingly. Keyboard patterns like qwerty , zxcvbn , or 1qaz2wsx are also in the pattern library. ## 🚨 Why we run a second check alongside zxcvbn zxcvbn already includes its own internal dictionary of roughly 10,000 breached passwords as part of its pattern-matching corpus — but that dictionary is one input among many in a probabilistic model, and it isn't surfaced to you directly. On top of that model, we run a second, much simpler check: an exact, case-insensitive match against a standalone list of the 10,000 most commonly used and breached passwords (sourced from large-scale leaked-password research via the SecLists project). If your password is an exact match, we show an unmistakable warning — not a score, not a suggestion, a certainty: this exact string is one an attacker will try in the first few seconds of any real attack. This check runs entirely in your browser with no network request, the moment you finish typing — there's no meaningful computation involved, just a lookup against a fixed list. Note that it's deliberately narrow: it only catches exact matches. A password like "Password123!" won't trip this specific alert, but zxcvbn's pattern analysis will still correctly identify it as weak. The two checks are complementary, not redundant. ## 🔢 Understanding Entropy Entropy is a measure of unpredictability, expressed in bits. The more bits of entropy a password has, the harder it is to crack by brute force. It's calculated based on the size of the character set and the length of the password: However, entropy calculated this way is an upper bound — if your password contains patterns (dictionary words, repeats, keyboard walks), the effective entropy is much lower. That's exactly what zxcvbn corrects for: it measures the actual guesswork required, not the theoretical maximum. As a rule of thumb, aim for at least 70–80 bits of effective entropy for important accounts. Our generator's default 16-character random password achieves this comfortably. ### 🌐 Online throttled Represents a typical login form with rate limiting. Attackers submit guesses one by one over a web interface. Most sites block accounts after 5–10 failed attempts, so this is the most realistic scenario for most accounts. ### 🌐 Online unthrottled A login endpoint with no rate limiting or lockout. Attackers can spam guesses freely. Unfortunately common on poorly-secured sites. Your password should survive at least this level. ### 💾 Offline slow hash Represents an attacker who has stolen a database of passwords hashed with a slow algorithm like bcrypt, scrypt, or Argon2. These are deliberately slow to compute. Good sites use these. ### ⚡ Offline fast hash Represents a database breach where passwords were hashed with a fast algorithm (MD5, SHA-1, unsalted SHA-256) — or stored in plaintext. Modern GPUs can test 10+ billion guesses per second. This is the worst case and your password's primary target. ## 🛡️ Checking a password against Have I Been Pwned — without ever sending it The strength checker and generator both run entirely offline in your browser. The one exception is the optional "Check for Breaches" button, which asks a simple question: has this exact password appeared in a known data breach? Answering that safely — without transmitting the password itself — uses a technique called k-anonymity , and it works like this: Because only a 5-character hash fragment ever leaves your device — shared by hundreds of other unrelated passwords — neither Have I Been Pwned nor anyone intercepting the request can determine what password you typed, or even that a request corresponds to a specific password at all. This is the same method used by browsers like Firefox and password managers like 1Password for their built-in breach-check features. This request is opt-in only — it never runs automatically. Everything else on this site (strength analysis, password and passphrase generation) never touches the network at all. ## See it in action Try the checker with your own passwords and see exactly how the analysis plays out. --- ## PAGE: FAQ URL: https://passwordstrength.net/faq.html Summary: 98 real questions about password strength, generators, breach checking, PINs, WiFi security, 2FA/TOTP, and policy compliance — answered and fact-checked against current NIST and PCI DSS standards. Searchable FAQ. ### No questions matched " " Try a different search term, or browse by category using the links above. ## Still have a question? The fastest way to get a real answer for your specific password is to try the tool itself. --- ## PAGE: Glossary URL: https://passwordstrength.net/glossary.html Summary: A searchable glossary of 200 password security and cybersecurity terms — cryptography, password generation, breach auditing, PINs, WiFi security, 2FA/TOTP, automation, and compliance — every definition checked for technical accuracy. ### No terms matched " " Try a different search term, or browse by category using the links above. ## Want to see these terms in action? Every category above links to the tool it applies to — the best way to understand a term is to try it. --- ## PAGE: About URL: https://passwordstrength.net/about.html Summary: Learn about PasswordStrength.net — a free, privacy-first password security tool built to keep your passwords safe and your data private. No servers, no tracking. ## Our mission is simple: make password security accessible to everyone. Billions of accounts are compromised every year because of weak or reused passwords. Most people don't get real feedback on whether their password is actually secure — they just see a colored bar that doesn't mean much. We built PasswordStrength.net to change that. Using the zxcvbn engine (originally developed by Dropbox), we give you a realistic picture of how long it would actually take an attacker to crack your password — not just how many character types you've used. And we do it completely in your browser. Your passwords never leave your device. ### Privacy First Everything runs in your browser. We have no back-end that ever receives your passwords. No analytics on what you type. No logs. ### Honest Feedback We won't tell you a password is "strong" just because it has a capital letter and a number. We use real attack modeling to give you real answers. ### Always Free Password security shouldn't cost money. Our core tools will always be free and ad-free. No paywalls, no upsells, no sign-ups required. ### Open Source Don't take our word for it. Our code is open for review. The zxcvbn library we rely on is fully auditable and battle-tested in production. ### No Bloat Fast, focused tools. We don't clutter the experience with features that don't serve your security. Simple UI, serious engineering. ### Accessible We design for everyone — from security professionals to people checking a password for the first time. Plain language, clear visuals. ### Constantly Updated The threat landscape evolves fast. We keep our tools, wordlists, and guidance current with the latest security research and breach data. ### Works Everywhere Desktop, tablet, or phone — our tools are fully responsive and tested across all modern browsers. No app download required. ### Community Driven We listen to feedback from real users. Feature suggestions, bug reports, and security disclosures are all taken seriously and acted upon. ## Ready to test your password? Use our free strength checker — no account required, nothing ever leaves your browser. --- ## PAGE: Privacy Policy URL: https://passwordstrength.net/privacy.html Summary: Our privacy policy in plain English. We never store your passwords. Everything runs in your browser — no tracking, no data collection, zero password data stored. ### Zero Password Data We never see, store, or transmit any password you type. Full stop. (The one opt-in exception — a privacy-preserving breach check — is detailed in Section 5.) ### Client-Side Only All analysis runs in your browser. No server receives your input. ### Analytics & Ads We use Google Analytics and AdSense. Neither ever sees your passwords. ## Table of Contents - 1. Overview - 2. What We Don't Collect - 3. What We Do Collect - 4. Cookies & Local Storage - 5. Third-Party Services - 6. Contact Form Data - 7. Your Rights - 8. Children's Privacy - 9. Changes to This Policy - 10. Contact Us ## 1. Overview PasswordStrength.net ("we", "us", "our") operates a free password security tool available at passwordstrength.net. This Privacy Policy explains how we handle information when you use our website. The short version: we built this tool to be private by design . The core functionality — password analysis and generation — runs entirely in your browser using JavaScript. Your passwords are never sent to any server, never logged, and never stored. 🔒 The most important thing to know: PasswordStrength.net has no server-side component that processes passwords. The zxcvbn library runs locally in your browser tab. You could disconnect from the internet after the page loads and the tool would still work. ## 2. What We Don't Collect To be completely explicit, we do not collect, transmit, store, or process: - Any password you enter into the strength checker, in full or in any reversible form - Any password generated by the password generator, in full or in any reversible form - Keystroke data or timing data from the password input - Any form of behavioral tracking tied to specific users - Your name, email, or any personally identifying information unless you contact us - Location data beyond country-level (from analytics) - Device fingerprints or cross-site tracking identifiers The one exception: if you click the optional "Check for Breaches" button on the checker or generator, your browser sends the first 5 characters of a SHA-1 hash of that password to the Have I Been Pwned "Pwned Passwords" API to check it against known breaches. This is called k-anonymity — the partial hash is shared by hundreds of unrelated passwords and cannot be reversed back into your actual password. This request only ever happens when you explicitly click the button; it is never automatic. See Section 5 for details. ## 3. What We Do Collect We use privacy-respecting, aggregated analytics to understand how many people use the site and which pages are most visited. This data is: - Aggregated — we see counts, not individual user journeys - Non-identifying — we cannot trace any statistic to a specific person - Not shared — we do not sell or share analytics with third parties for advertising Our server logs may also temporarily store standard HTTP request data (IP address, browser, timestamp) for security and abuse prevention purposes. These logs are automatically purged after 7 days and are never used for profiling. ## 4. Cookies & Local Storage We do not set any persistent tracking cookies. The only browser storage we use: - Session state — which tab you're on (checker vs. generator). This is discarded when you close the tab. - Password history — the "Recent Passwords" feature stores generated passwords in your browser's sessionStorage . This is local to your browser, never transmitted to us, and is erased when you close the tab. Note on third-party fonts: We load fonts from Google Fonts ( fonts.googleapis.com ). Google may receive a request log entry from your browser. If this concerns you, you can block fonts via your browser or a content blocker — the site functions without them. Analytics and advertising cookies: Google Analytics sets cookies (such as _ga , _gid ) to distinguish users and track sessions. Google AdSense sets cookies to deliver and measure advertisements. These cookies persist for up to 2 years. You can manage or delete them via your browser settings or opt out using the links in Section 5. ## 5. Third-Party Services We use the following third-party services. None of these receive your passwords: - Google Fonts — for typography (DM Sans, DM Mono). Loaded from fonts.googleapis.com . Subject to Google's Privacy Policy . - zxcvbn (Cloudflare CDN) — the password analysis library is loaded from cdnjs.cloudflare.com . Cloudflare may log the request. The library runs entirely client-side after download. - Google Analytics — we use Google Analytics to understand aggregate site usage (pages visited, session duration, general geography). Google Analytics sets cookies and may collect your IP address. Data is processed by Google under their Privacy Policy . We have enabled IP anonymisation. You can opt out via the Google Analytics Opt-out Browser Add-on . - Google AdSense — we display advertisements served by Google AdSense. Google may use cookies and device identifiers to show you personalised ads based on your interests and browsing behaviour. You can manage ad personalisation at Google Ad Settings . For more information see Google's advertising policies . - Have I Been Pwned — Pwned Passwords API ( api.pwnedpasswords.com ) — used only if you click the optional "Check for Breaches" button. We send the first 5 characters of a SHA-1 hash of the password (never the password or its full hash) using the k-anonymity method documented at haveibeenpwned.com . This request is never sent automatically. See How it Works for a full explanation. Note: Neither Google Analytics nor Google AdSense ever receives any password you type. All password analysis runs locally in your browser before these services load. The only third-party service that ever receives anything password-related is the optional, opt-in breach check described above — and even then, only an irreversible partial hash fragment, never the password. ## 6. Contact Form Data If you use our Contact page to send us a message, we collect: - Your name (as provided) - Your email address (as provided) - The content of your message This data is used solely to respond to your enquiry. We do not add you to any mailing list without explicit opt-in, and we do not share your contact details with third parties. Contact data is retained for up to 12 months and then deleted. ## 7. Your Rights Depending on your location, you may have rights regarding your personal data under GDPR, CCPA, or other applicable laws. These include the right to access, correct, or delete data we hold about you. Since we collect essentially no personal data in normal site use, exercising these rights is straightforward. If you've contacted us and want your message deleted, email us at privacy@passwordstrength.net and we'll remove it within 5 business days. ## 8. Children's Privacy PasswordStrength.net is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted contact information to us, please contact us and we will delete it promptly. ## 9. Changes to This Policy We may update this policy as our service evolves. If we make material changes that affect how we handle your data, we'll update the "Last Updated" date at the top of this page. Continued use of the site after changes constitutes acceptance of the updated policy. We will never silently change our stance on password data privacy — if anything changes there, we will communicate it prominently on the site. ## 10. Contact Us If you have questions about this Privacy Policy or our data practices, you can reach us through our Contact page or by email at privacy@passwordstrength.net . For security disclosures specifically, please use the subject line "Security Disclosure" and we'll treat it as priority. --- ## PAGE: Your strong password isn't enough: the case for two-factor authentication URL: https://passwordstrength.net/blog-2fa.html Summary: Even a 60-bit entropy password can be rendered useless by phishing or credential stuffing. Here is how two-factor authentication protects you when passwords fail. You've set a strong, unique 18-character random password for your email account. Well done — it will resist brute-force attacks for centuries. But it can still be stolen in seconds. Here's why passwords alone aren't enough, and why 2FA changes everything. ## Passwords can be stolen without being cracked Cracking is just one way attackers get your password. The more common routes are: - Phishing — you type your password into a fake login page. The attacker gets it instantly, regardless of complexity. - Data breaches — the service you use gets hacked and your password hash (or plaintext) is exposed. - Malware — a keylogger or info-stealer on your device captures your password as you type it. - Credential stuffing — attackers use username/password combos from one breach to try logging into other services. ⚠️ The hard truth: Even a perfectly generated, unique, 20-character password gives you zero protection if it's stolen via phishing or malware. Password strength is irrelevant when the password itself is compromised. ## What 2FA actually does Two-factor authentication (2FA) requires a second piece of evidence beyond your password — something you have (your phone, a hardware key) rather than something you know (your password). Even if an attacker has your exact password, they can't log in without the second factor. The most common 2FA types, ranked by security: - Hardware security keys (YubiKey, Google Titan) — strongest, immune to phishing - Authenticator apps (Authy, Google Authenticator) — strong, time-based codes - Push notifications (Duo, Okta) — convenient, but vulnerable to MFA fatigue attacks - SMS codes — better than nothing, but vulnerable to SIM-swapping ## Which accounts need 2FA most? Prioritize 2FA on: your email account (controls password resets for everything else), your password manager, your bank and financial accounts, your work accounts, and any account tied to your phone number or identity. After those, enable it everywhere that supports it — it takes 30 seconds to set up. ✅ The combination that works: Strong unique password + 2FA makes your account resistant to both cracking and credential theft. Neither alone is as effective as both together. ## The bottom line Think of your password as the lock on your door and 2FA as the deadbolt. A strong lock matters, but a burglar who has a copy of your key bypasses it entirely. The deadbolt requires something they don't have. Enable 2FA today — starting with your email and password manager. --- ## PAGE: What to do immediately after your data is breached URL: https://passwordstrength.net/blog-after-a-breach.html Summary: You just found out you are in a data breach. Here is an exact step-by-step response in priority order — for the first 30 minutes and beyond. You've received an email saying a service you use has been breached, or you've seen it in the news. What do you actually do? Here's an exact step-by-step response, in priority order. ## In the first 30 minutes ### 1. Change the breached password immediately Go to the affected service and change your password to a new, unique, randomly generated one. Don't reuse anything you've used before. If the service requires you to be logged in to change your password and you can still access it, do it now. If not, use the "Forgot password" flow. ### 2. Change it everywhere you reused it This is the painful part. If you used that same password on other sites, every one of those accounts is now compromised too. Log into each and change the password. This is also the moment that makes the case for a password manager permanently — this situation is the exact problem it prevents. ### 3. Enable 2FA on the breached account If the service offers 2FA and you don't have it enabled, enable it now. Even if attackers have your new password somehow, they can't get in without the second factor. ## In the first 24 hours ### 4. Check what data was exposed Read the breach notification carefully. What was actually taken? Passwords? Payment card numbers? Address? Social Security number? The type of data determines your next steps. If payment cards were exposed, notify your bank. If government ID numbers were exposed, consider a credit freeze. ### 5. Watch for phishing follow-ups Attackers use breach data to craft convincing phishing emails. In the days after a breach, you may receive emails pretending to be the affected service asking you to "verify your account" or "confirm your new password." Don't click links in these emails — go directly to the site by typing the URL. ⚠️ Credit freeze for serious breaches: If your Social Security number, date of birth, or financial account numbers were exposed, place a credit freeze with all three major bureaus (Equifax, Experian, TransUnion). This prevents anyone from opening new credit in your name. ## Longer term Use this breach as motivation to do the security housekeeping you've been putting off: install a password manager, audit your passwords, enable 2FA on all important accounts, and check haveibeenpwned.com for other exposures you may have missed. ✅ Breach response checklist: Change breached password → change it everywhere reused → enable 2FA → identify what was exposed → watch for phishing → credit freeze if financial data was taken → install a password manager so this never cascades again. --- ## PAGE: AI-powered password cracking: how much faster does it make attacks? URL: https://passwordstrength.net/blog-ai-cracking.html Summary: Large language models trained on breach data can prioritize guesses far more intelligently. We examine the real-world impact on password security. Headlines about AI cracking passwords in seconds are partly true and partly overhyped. Here's what AI-assisted password cracking actually looks like, and what it means for the passwords you're using today. ## Traditional cracking vs. AI-assisted cracking Traditional password cracking uses wordlists and rule-based transformations: start with common passwords, apply mutations (capitalize, append numbers, substitute symbols), and try permutations. It's effective against predictable passwords but inefficient at guessing truly random ones. AI-assisted cracking — particularly tools trained on large breach datasets using language models — can do something more sophisticated: it learns the distribution of human-chosen passwords and prioritizes guesses accordingly. Instead of following fixed rules, it generates plausible candidates based on what humans actually choose. ## What research shows A 2023 study using a PassGAN (Generative Adversarial Network trained on breach data) found it could match or outperform traditional rule-based approaches for short, human-patterned passwords — particularly those between 6–10 characters. For longer, truly random passwords, it showed no meaningful advantage over brute force. The key finding: AI cracking is a better version of dictionary attacks, not a bypass of entropy . It exploits human predictability more efficiently. It does not reduce the security of truly random passwords. ⚠️ Who is actually at risk: If your password is based on a word, phrase, name, or predictable pattern — even with modifications — AI-assisted tools are meaningfully better at guessing it. If your password is genuinely random, they offer no advantage. ## GPU acceleration is the bigger story While AI gets the headlines, GPU-accelerated cracking has been the bigger practical change over the past decade. Modern consumer GPUs can test 10+ billion MD5 hashes per second. This means any password under 8 random characters is crackable in hours, and shorter ones in seconds, using hardware available for under $1,000. This makes the choice of hashing algorithm critical on the service side: bcrypt, scrypt, and Argon2 are designed to be slow to compute, limiting attackers to thousands of guesses per second even with powerful hardware. Unfortunately, many older services still use MD5 or SHA-1. ## What you should do - Use passwords of 16+ characters — length is the primary defense against all cracking approaches - Ensure your passwords are genuinely random, not pattern-based - Use unique passwords per site — even if one is cracked in a breach, others are safe - Enable 2FA — even a cracked password requires the second factor to log in ✅ The good news: AI cracking doesn't change what secure passwords look like — it just makes the case for randomness more urgent. A 16+ character random password remains effectively uncrackable with any foreseeable technology, AI-assisted or otherwise. --- ## PAGE: Best authenticator apps in 2025: ranked and reviewed URL: https://passwordstrength.net/blog-authenticator-apps.html Summary: Not all authenticator apps are equal. We compare Aegis, Raivo, Authy, and Google Authenticator on security, backup options, and ease of use. Switching from SMS to an authenticator app is one of the best security upgrades you can make. But not all authenticator apps are equal — they differ on backup options, security model, and ease of use. Here's how the top options compare in 2025. ## What to look for - Encrypted backup — what happens if you lose your phone? - Open source — can the security be independently verified? - Multi-device support — can you access codes from multiple devices? - No cloud storage of seeds — does the app upload your secret keys anywhere? ### 🥇 Aegis (Android) — Best overall Open source, fully offline, encrypted local backup. No cloud, no accounts, no tracking. The gold standard for Android users who prioritise security. ### 🥇 Raivo OTP (iOS) — Best for iPhone Open source, iCloud backup with end-to-end encryption. Clean interface, actively maintained. Our top pick for iOS. ### 🥈 Authy — Best for multi-device Encrypted cloud backup, works across all your devices. Closed source and requires a phone number, but the backup system is genuinely useful for most people. ### ⚠️ Google Authenticator — Use with caution Now offers Google account backup, which is convenient but means your 2FA seeds are in Google's cloud. Acceptable if you fully trust and secure your Google account. ## Setting up a new authenticator app - Install your chosen app - Go to each account's security settings and find the 2FA/authenticator option - Scan the QR code with the app - Save the backup codes provided — store these offline, they're your recovery if you lose the app - Confirm the setup by entering a code from the app ⚠️ Save your backup codes: If you lose access to your authenticator app and have no backup codes, you can be permanently locked out of your accounts. Write them down and store them somewhere safe — not on your phone. ✅ This weekend: Install Aegis (Android) or Raivo (iOS), then migrate your three most important accounts — email, password manager, bank — from SMS to authenticator app. Takes about 15 minutes total. --- ## PAGE: The biggest password breaches in history — and what we learned URL: https://passwordstrength.net/blog-biggest-breaches.html Summary: From RockYou in 2009 to Yahoo's 3 billion accounts — the most significant breaches and the lessons each one taught us about password security. Data breaches have been happening since the internet went mainstream, but the scale and impact have grown dramatically. Each major breach taught us something about how passwords fail and what protects us. Here's a look at the most significant ones. ## RockYou (2009) — 32 million passwords, plaintext The breach that changed password security discussions. RockYou, a social gaming company, stored 32 million user passwords in plaintext — no hashing at all. When attackers got in, they got every password directly. The leaked list became the foundation of password cracking wordlists used to this day. Lesson: services must hash passwords. Users must not reuse passwords across sites. ## LinkedIn (2012) — 117 million passwords, unsalted SHA-1 LinkedIn hashed passwords with SHA-1 but didn't use salts — meaning identical passwords produced identical hashes, and a single cracked hash revealed every account using that password. Over 90% of the passwords were cracked within days of the data appearing online. Lesson: proper hashing requires salts. Fast algorithms like SHA-1 are inappropriate for passwords. ## Adobe (2013) — 153 million records, encrypted (badly) Adobe used 3DES encryption rather than hashing — a fundamental misunderstanding of password storage. Worse, they used the same encryption key for all passwords, so identical passwords produced identical ciphertext. Analysts cracked passwords using frequency analysis. Lesson: encryption is not hashing. Only slow, salted hashing algorithms (bcrypt, Argon2) are appropriate for passwords. ## Yahoo (2013–2014) — 3 billion accounts The largest breach in history by account count. Yahoo was breached in 2013 and 2014, but didn't disclose it until 2016. The 2013 breach involved MD5 hashed passwords (fast and crackable); the 2014 breach used bcrypt (much stronger). Lesson: disclosure delays leave users exposed for years. Algorithm choice matters enormously. ⚠️ These breaches are still active: Credentials from all of these breaches are still in circulation and used in credential stuffing attacks today. If you had accounts on any of these services and haven't changed those passwords (or reused them), they should be considered compromised. ## What every breach teaches us - You cannot control how services store your password — but you can limit the damage by never reusing passwords - Fast hashing algorithms (MD5, SHA-1) are broken for password storage — check if your services use bcrypt or Argon2 - Breaches are often discovered and disclosed years after the fact — change old passwords proactively - Credential stuffing works at scale — it's automated and costs attackers almost nothing ✅ Your defence: Unique passwords per site means any single breach gives attackers exactly one account — the one that was breached. Nothing else. A password manager makes this trivially easy to maintain. It's the one change that neutralises the impact of every breach on this list. --- ## PAGE: Most common passwords of 2024 — analyzed from real breach data URL: https://passwordstrength.net/blog-common-passwords.html Summary: We analyzed 100 million real-world passwords from 2024 breach datasets. The results are both predictable and alarming. Every year, security researchers analyze leaked credential databases to find out what passwords people actually use. The results are consistently alarming — and remarkably consistent year after year. Here's what 2024's breach data tells us. ## The top offenders Based on analysis of breach databases compiled through 2024, the most common passwords remain depressingly predictable: - 123456 — the perennial #1, appearing in hundreds of millions of accounts - password , password1 , Password1! - 123456789 , 12345678 , 1234567890 - qwerty , qwerty123 , Qwerty1! - iloveyou , sunshine , princess - admin , letmein , welcome - monkey , dragon , master ⚠️ If you use any password on this list: Change it immediately. These passwords are tried first in every dictionary attack, and they appear in every wordlist a cracker would use. They provide essentially zero security. ## Patterns that don't help Beyond specific words, certain patterns are so common they're modeled by every serious cracking tool: - Any word + 1 or 123 (e.g., football123 ) - Any word + ! at the end (e.g., sunshine! ) - Capitalizing the first letter (e.g., Dragon ) - Leet-speak substitutions: @ →a, 0 →o, 3 →e, 1 →l - Years appended: password2024 , password2025 - Keyboard walks: qwerty , asdfgh , 1qaz2wsx ## Why does this keep happening? Humans are bad at choosing random strings. We naturally gravitate toward meaningful words, familiar patterns, and minimal effort. When a site forces us to add complexity, we apply the same predictable transformations. The solution isn't to try harder to be random — it's to use a tool that is actually random. ✅ The fix is simple: Let a generator create your passwords. A random 16-character string has nothing in common with any breach wordlist. Use our generator and a password manager — no memorization required. --- ## PAGE: Your passwords on the dark web: how to find out and what to do URL: https://passwordstrength.net/blog-dark-web-passwords.html Summary: Every major data breach results in stolen credentials being traded on dark web forums. Here is how to check if yours are exposed — and the free tools that actually work. Every major data breach eventually results in stolen credentials being traded or published on dark web forums and paste sites. The question isn't whether your data has ever been exposed — statistically it likely has — but whether your current passwords are still at risk. ## What happens after a breach When a company is breached and password hashes are stolen, attackers crack as many as possible offline. Cracked plaintext passwords, along with email addresses, are then compiled into credential lists and sold on dark web marketplaces. These lists are used for credential stuffing attacks — automated tools that try each username/password combo across hundreds of sites. ## How to check if your credentials are exposed ### Have I Been Pwned (haveibeenpwned.com) The most trusted free service for breach checking. Enter your email address to see which breaches it appears in, or check specific passwords using their k-anonymity API — your actual password is never transmitted. Created and maintained by security researcher Troy Hunt, it indexes billions of records from thousands of breaches. ### Google Password Checkup Built into Chrome and Android, this tool checks your saved passwords against known breach databases using privacy-preserving cryptography. Find it in Chrome Settings → Passwords → Check passwords. ### Firefox Monitor Mozilla's breach monitoring service, also powered by Have I Been Pwned data. Offers ongoing alerts when your email appears in new breaches. ⚠️ Avoid paid "dark web monitoring" scams: Many services charge monthly fees to "monitor the dark web" for your data. Most use the same public breach data as the free tools above. Save your money and use haveibeenpwned.com directly. ## What to do if your credentials are exposed - Change the password on the breached service immediately - If you reused that password anywhere else, change it on every site - Enable 2FA on the affected account - Monitor for suspicious activity on connected accounts - Going forward, use a password manager to ensure every account has a unique password ✅ The permanent fix: Credential stuffing only works when you reuse passwords. If every account has a unique randomly generated password, a breach at one site can never compromise another. Set this up once with a password manager and you're protected permanently. --- ## PAGE: Diceware: the old-school method that still makes the strongest passwords URL: https://passwordstrength.net/blog-diceware.html Summary: A 1995 method using physical dice and a wordlist. Nearly 30 years later, Diceware remains one of the most cryptographically sound approaches to memorable passwords. In 1995, Arnold Reinhold published a simple method for generating truly random, memorable passphrases using nothing but a dictionary list and a physical die. Nearly thirty years later, Diceware remains one of the most cryptographically sound approaches to human-memorisable passwords ever devised. ## How Diceware works The EFF's Diceware wordlist contains 7,776 words — exactly 6⁵, the number of outcomes from rolling a six-sided die five times. To pick a word, roll a die five times and concatenate the results (e.g. 3-1-4-5-2 = 31452). Look up that number in the wordlist. Repeat for each word in your passphrase. The beauty is in the math: every word is chosen with equal probability from 7,776 candidates, using a physical process that can't be predicted or biased by human psychology. ## The entropy per word log₂(7776) ≈ 12.9 bits per word. Four words: ~52 bits. Five words: ~65 bits. Six words: ~78 bits. At six words, even an attacker capable of a trillion guesses per second would need thousands of years to exhaust the possibility space by brute force. 💡 Five vs six words? Five words is fine for most purposes. Use six for your password manager master password or anything that will never change and protects everything else. ## The EFF wordlist improvement The original Reinhold wordlist contained some obscure and hard-to-spell words. In 2016, the Electronic Frontier Foundation published an improved wordlist specifically designed for memorability — words that are common, concrete, and easy to visualise. This is the list our generator draws from. ## Physical dice vs digital generation Physical dice are theoretically purer — no software, no random number generator to trust. But a cryptographically secure pseudo-random number generator (CSPRNG), like the one used in our generator and in most operating systems, is indistinguishable from true randomness for this purpose. The practical security difference is zero. ## When to use Diceware vs a random password - Use Diceware/passphrase for passwords you must memorise: manager master password, computer login, encrypted drive - Use a random password for everything stored in your manager — higher entropy per character, no memorisation needed ✅ Try it: Use our passphrase generator set to six words. That passphrase will be stronger than any password you've ever manually created — and with a bit of practice, easier to remember too. --- ## PAGE: Entropy 101: understanding password strength in plain English URL: https://passwordstrength.net/blog-entropy.html Summary: Bits of entropy sound intimidating. We explain the concept without a math degree — and show you why length beats complexity every time. Security advice often mentions "entropy" as though it explains everything. But what does it actually mean, and why does it matter for your passwords? Here's the plain-English version. ## Entropy is unpredictability In information theory, entropy measures how unpredictable something is. High entropy = hard to guess. Low entropy = easy to guess. When applied to passwords, entropy (measured in bits) tells us roughly how many guesses an attacker would need to crack it by brute force. Each additional bit of entropy doubles the number of guesses required. So a password with 40 bits of entropy needs about a trillion guesses. A password with 41 bits? Two trillion. The math scales fast. ## How entropy is calculated The formula is straightforward: Entropy = length × log₂(charset size) - Lowercase only (26 chars): ~4.7 bits per character - Lower + upper (52 chars): ~5.7 bits per character - Lower + upper + digits (62 chars): ~5.95 bits per character - All printable characters (94 chars): ~6.55 bits per character This means a random 16-character password using all character types has roughly 104 bits of entropy . That's effectively uncrackable with any foreseeable hardware. ## The critical word: "random" The formula above assumes every character is chosen randomly from the full character set. Human-chosen passwords radically depart from this. P@ssw0rd might theoretically have 52+ bits of entropy by the formula, but its actual "guessing entropy" — accounting for the fact that it follows a known dictionary-word pattern — is closer to 1–2 bits. Attackers try it in the first thousand guesses. ⚠️ Theoretical vs. practical entropy: Always think about practical entropy — how many guesses does an attacker actually need, given that they use dictionaries and rules? This is what zxcvbn measures, and it's far more meaningful than the formula alone. ## What entropy level should you aim for? Current guidance from NIST and cryptographers: - Below 40 bits — crackable quickly even with modest hardware. Avoid. - 40–60 bits — acceptable for low-value accounts, offline attacks are a concern - 60–80 bits — good for most accounts, resists offline fast-hash attacks for years - 80+ bits — excellent, resists even future hardware for the foreseeable future A random 12-character password (all character types) gives ~79 bits. A random 16-character password gives ~105 bits. Either is a good target for important accounts. ✅ Bottom line: Length beats complexity. Adding two random characters to a password adds more security than switching from lowercase to mixed-case. Our generator defaults to 16 characters — start there. --- ## PAGE: Hardware security keys explained: are they worth it? URL: https://passwordstrength.net/blog-hardware-keys.html Summary: YubiKeys and similar devices are the strongest 2FA available — phishing-proof, tamper-resistant, and under $50. Here is everything you need to know. Hardware security keys — small USB or NFC devices like YubiKey — are the strongest form of two-factor authentication available to consumers. They're completely immune to phishing, can't be remotely compromised, and cost less than $50. So why doesn't everyone use one? ## How hardware keys work A hardware key stores a cryptographic private key that never leaves the device. When you log in, the website sends a challenge; your key signs it with the private key and returns the signature. The website verifies the signature with your stored public key. Crucially, the key is cryptographically bound to the exact domain — it will not respond to phishing sites, even perfect clones of the real thing. ## Why they're better than authenticator apps - Phishing-proof — the key verifies the domain, so a fake login page gets nothing - No codes to intercept — there's no 6-digit code an attacker could steal in real-time - No software to compromise — malware on your computer can't extract the key - Faster to use — one tap or plug-in, no code entry ## Popular options ### YubiKey 5 Series (~$50) The industry standard. Works with USB-A, USB-C, NFC. Compatible with thousands of services. Extremely durable. Our top recommendation. ### Google Titan Key (~$30) Made by Google, solid security, available in USB-C and NFC versions. Good option if you're heavily invested in Google services. ### Thetis FIDO2 (~$25) Budget option, FIDO2 compliant, rotating protective cover. Good entry point if you want to try hardware keys without committing to a YubiKey price. ### OnlyKey (~$47) Open source hardware and firmware, PIN-protected, stores multiple credentials. Best for users who want maximum transparency and control. ## Who should buy one? Hardware keys are particularly valuable for: people who handle sensitive work data, journalists or activists at high risk of targeted attacks, anyone who has been phished before, and anyone who wants the highest possible security on their email and password manager accounts. For average users, an authenticator app is sufficient — but a key is never overkill. ⚠️ Buy two: Always buy at least two hardware keys and register both on each important account. If you lose or break your only key and have no backup, you could be locked out permanently. ✅ Getting started: Buy a YubiKey 5C NFC (~$55). Register it on your Google/email account and password manager first. Then work through your other accounts. Keep the second key somewhere safe as a backup. --- ## PAGE: Teaching kids about password safety: a parent's guide URL: https://passwordstrength.net/blog-kids-online-safety.html Summary: Children are creating accounts younger than ever. Age-appropriate advice for building good password habits that protect them online for life. Children are creating accounts younger than ever — gaming platforms, school tools, social media. Teaching them good password habits early builds a foundation that protects them for life. Here's how to make those conversations practical and stick. ## Start with why, not rules Rules without context don't stick. Before telling a child what to do, explain the problem in terms they understand. A good analogy: a password is like a house key. You wouldn't give your house key to a stranger, write it on the front door, or use the same key for every lock you own. Passwords work the same way. ## Age-appropriate guidance ### Ages 6–10: the basics At this age, focus on three things: never share passwords (even with friends), tell a trusted adult if something feels wrong online, and use different passwords for different things. Let them watch you use a password manager so they see it's normal. ### Ages 11–14: building good habits Introduce passphrases — four random words are easy to remember and genuinely secure. Explain what phishing looks like: someone pretending to be a friend, game, or website to steal their login. Practice spotting fake login pages together. ### Ages 15+: real security thinking Introduce a password manager and let them set one up for their accounts. Talk about 2FA and enable it on their important accounts. Discuss what happens in data breaches and why password reuse is dangerous. 💡 Make it hands-on: Use our password checker together. Let them type weak passwords and see the score. Then generate a strong one and show the difference. Seeing it work is more memorable than any explanation. ## What not to do - Don't let them use their name, birthday, pet's name, or school name in passwords - Don't let them share passwords with friends — even best friends - Don't write passwords on sticky notes near the computer - Don't use the same password for school accounts, gaming, and social media ## Lead by example Children model adult behaviour. If they see you using a password manager, taking 2FA seriously, and talking about online safety as a normal part of life — they will too. Make it a household habit, not a one-time lecture. ✅ This week's challenge: Sit down with your child, check one of their accounts on haveibeenpwned.com, help them change one weak password to a strong passphrase, and talk about what to do if someone asks for their password online. --- ## PAGE: How to create a strong password you can actually remember URL: https://passwordstrength.net/blog-memorable-strong.html Summary: Some passwords must be memorized — your password manager's master password chief among them. Here's how to make one strong and memorable. The best password is one stored in a password manager — but there are situations where you genuinely need to memorize a password: your manager's master password, your computer login, your work VPN. Here's how to make those passwords both strong and memorable. ## The Diceware method Diceware is the gold standard for memorable strong passwords. Roll a physical die five times to get a five-digit number, look it up in the EFF's Diceware wordlist, and repeat for four to six words. The result is something like clam-fable-anvil-swift-piano — random, memorable, and genuinely strong. Five words from the EFF list gives ~65 bits of entropy. Six words gives ~78 bits. Both are strong enough for any purpose. 💡 Why physical dice? Dice rolls are truly random. Human-selected "random" words aren't — we gravitate toward familiar words and patterns. Our passphrase generator uses a cryptographically secure random source and achieves the same result digitally. ## The memory palace technique Once you have your random passphrase, create a vivid mental image connecting the words. clam-fable-anvil-swift-piano : imagine a giant clam reading a fable, getting hit by a falling anvil, which swiftly lands on a piano. The stranger and more vivid the image, the easier it is to remember. ## What not to do - Don't use a meaningful phrase or song lyric — those are dictionary-attackable - Don't use words that relate to each other (they become predictable) - Don't use fewer than four words — the entropy drops significantly - Don't substitute letters with numbers/symbols in a passphrase — it adds almost nothing and makes it harder to type ## For passwords you must type regularly If you need to type a passphrase frequently, practice it 10–15 times right after creating it. Muscle memory forms quickly. Within a few days of daily use, it becomes automatic — like typing your name. ✅ Right now: Use our passphrase generator to create a five-word passphrase. Write it down temporarily (store it safely), practice typing it a dozen times, then destroy the paper once it's memorised. You now have a strong memorable password. --- ## PAGE: Passkeys explained: is this the end of passwords? URL: https://passwordstrength.net/blog-passkeys.html Summary: Apple, Google, and Microsoft are betting big on passkeys. We explain the technology, its limitations, and whether you should start switching today. Apple, Google, and Microsoft have all bet big on passkeys as the successor to passwords. Major sites including Google, Apple ID, GitHub, PayPal, and eBay now support them. But what exactly are passkeys, how do they work, and should you switch? ## What is a passkey? A passkey is a cryptographic key pair that replaces your password. When you create a passkey on a site, your device generates a private key (stored securely on your device) and a public key (stored on the site's server). To log in, you authenticate locally using biometrics (Face ID, fingerprint) or your device PIN — your device then uses the private key to prove your identity without ever sending a password. The site never sees your private key. There's nothing to steal from their servers that can log you in. And because passkeys are cryptographically bound to the specific site, they're immune to phishing. ## Why passkeys are genuinely better than passwords - Phishing-proof — your device will only use a passkey for the exact site it was created for - No secret to steal — the server only stores your public key, which is useless to an attacker - No reuse problem — each site gets a unique key pair, so a breach at one site doesn't affect others - Nothing to memorize — authentication is a biometric or device PIN you already use - Resistant to brute force — cryptographic keys can't be guessed ✅ On security: Passkeys are strictly better than passwords for authentication security. There is no scenario where a passkey is weaker than a password for the same account. ## The current limitations - Coverage — most sites still don't support passkeys. You'll still need passwords for the majority of your accounts. - Cross-device sync — passkeys sync within an ecosystem (Apple, Google, or Windows) but cross-platform portability is still maturing. - Recovery — losing all your devices without a recovery method can lock you out permanently. - Business accounts — enterprise passkey support is still early-stage. ## Should you use passkeys now? Yes — for any site that supports them, enable passkeys. They're strictly safer than passwords and more convenient. But don't think of it as an alternative to good password hygiene: most of the internet still runs on passwords, and you need strong unique ones for all those accounts. ⚠️ The transition period: We're likely 3–5 years from passkeys being mainstream enough to replace passwords entirely. Until then, a password manager with strong unique passwords + 2FA remains the right approach for most accounts. ## The bottom line Passkeys represent the best login technology we've built — adopt them wherever supported. But they're not yet a reason to stop caring about password security. The two approaches will coexist for years, and your password manager remains essential in the meantime. --- ## PAGE: 5 rules for building a passphrase that's actually secure URL: https://passwordstrength.net/blog-passphrase-tips.html Summary: Passphrases are powerful — but only when done right. A weak passphrase can be easier to crack than a mediocre password. Here are the rules that matter. Passphrases are powerful — but only when done right. A weak passphrase can be easier to crack than a mediocre password. Here are five rules that separate genuinely strong passphrases from ones that just feel secure. ## Rule 1: the words must be truly random This is the most important rule. "I love my golden retriever" is not a passphrase — it's a sentence. Meaningful phrases, even long ones, are dramatically weaker than random word combinations because attackers model natural language patterns. Use a generator or physical dice. Do not choose words yourself. ## Rule 2: use at least four words, five is better Three random words gives ~39 bits of entropy from a 7,776-word list — marginal. Four words gives ~52 bits — acceptable. Five gives ~65 bits — strong. Six gives ~78 bits — excellent for a master password. Never go below four. ## Rule 3: don't modify the words to add "complexity" Adding ! at the end, capitalising words, or substituting letters with numbers does very little for a passphrase. It adds minimal entropy while making the passphrase harder to type and remember. The strength of a passphrase comes from word count and randomness, not character substitution. ## Rule 4: the separator matters less than you think Hyphens, spaces, dots — the choice of separator barely affects security. What matters is consistency so you can type the passphrase reliably. Pick one and stick to it. A space is fine. A hyphen is fine. Don't stress about it. ## Rule 5: never reuse a passphrase Passphrases are typically used for things you need to memorise — your manager master password, computer login. That means you'll use them repeatedly. Never use the same passphrase for two different purposes. If one is ever compromised (keylogger, shoulder surfing), the other stays safe. ✅ The benchmark: A five-word random passphrase from our generator scores 4/4 on our strength checker and resists offline attacks for centuries. Generate one now and start practicing it today. --- ## PAGE: Passphrases vs Passwords URL: https://passwordstrength.net/blog-passphrases.html Summary: Four random words can be stronger than a random 16-character password — and much easier to remember. We break down the entropy math. You've probably heard the advice: use a passphrase instead of a password. Four random words like correct-horse-battery-staple are supposedly stronger and easier to remember than a complex password. But is that actually true? Let's look at the math. ## What is a passphrase? A passphrase is a sequence of random words used as a password. The key word is random — words chosen randomly from a large list (like the EFF Diceware list of 7,776 words), not a phrase that means something to you or comes from a song or book. A meaningful phrase like ilovemydog is not a passphrase — it's a weak password. A passphrase sounds like nonsense: marble-clam-velvet-piston . ## The entropy math Each word chosen from a 7,776-word list contributes about 12.9 bits of entropy (log₂(7776)). Four words gives roughly 51.7 bits . Six words gives about 77.5 bits . A truly random 10-character password using all character types (94 possible characters) gives about 65.6 bits . So a five-word passphrase is roughly equivalent to a random 10-character password, and six words beats a random 12-character password. ## Head-to-head comparison ## The critical caveat: truly random The security of a passphrase depends entirely on the words being chosen randomly. Human-selected "random" words are far from random — we're drawn to words we know and use, often related words, and words that start with common letters. This dramatically reduces the actual entropy. The right way to generate a passphrase is to use a tool — like our passphrase generator — that uses a cryptographically secure random source. Or use the EFF's Diceware method with physical dice. ✅ Best of both worlds: Use a password manager with random 18+ character passwords for all your accounts. Use a 6-word random passphrase as your master password — it's strong enough and actually memorable. ## When passphrases win Passphrases are the clear winner in one scenario: passwords you must type and remember without a manager. Your computer login, your password manager master password, your work VPN. For these, a five or six-word passphrase gives you strong security you can actually memorize. For everything else — email, banking, social media, any site account — a randomly generated password stored in a manager will be longer, higher entropy, and just as secure. --- ## PAGE: Why "P@ssw0rd!" still gets you hacked URL: https://passwordstrength.net/blog-passw0rd.html Summary: Character substitution tricks were decent in 2005. In 2025 they are the first thing attackers model. Here is why — and what actually makes a password uncrackable. There's a common belief that making a password "complex" — mixing in capital letters, numbers, and symbols — makes it secure. It's the logic behind every IT department's password policy from the early 2000s. And it's wrong. P@ssw0rd! is not a strong password. It scores 0 out of 4 on a realistic strength meter and would be cracked in under a second in an offline attack. Yet it checks every box on a traditional complexity checker: uppercase, lowercase, number, special character, 9 characters. How is this possible? ## The problem with complexity rules Traditional password strength meters count character types. More types = higher score. The logic seems reasonable until you realize that attackers don't brute-force character by character — they start with dictionaries. Modern password cracking tools like Hashcat and John the Ripper don't try aaaaaaa , then aaaaaab . They start with the most common passwords from breach databases, then apply rules: capitalize the first letter, add ! at the end, substitute @ for a , substitute 0 for o . These rule sets are built from analyzing billions of real passwords that humans actually choose. ⚠️ Real attack order: Attackers try "password" → "Password" → "Password1" → "P@ssword" → "P@ssw0rd" → "P@ssw0rd!" — all before moving to truly random guesses. Your clever substitutions are already in their playbook. ## What the data says In breach analysis of hundreds of millions of real passwords, some consistent patterns emerge: - Over 60% of passwords follow predictable base-word + number + symbol patterns - The most common symbol appended to passwords is ! - The most common number appended is 1 or 123 - Leet-speak substitutions add fewer than 10 additional guesses to a cracker's list ## What actually makes a password strong? Two things matter above everything else: length and unpredictability . Length is powerful because it multiplies the search space exponentially. Every additional random character roughly doubles the time needed to crack the password. A 16-character truly random password is astronomically harder to crack than a 9-character "complex" one. Unpredictability means the password can't be predicted from patterns, words, or rules that attackers model. This is where human intuition fails us — we're bad at generating randomness, and our "random" choices are far more predictable than we think. ## The two proven approaches ### 1. Long random passwords (with a manager) Use a password manager to generate and store a truly random 16–20 character password for every account. You don't need to remember it — the manager does. Something like kX#9mQ2vLpR7nWz4 is essentially uncrackable with today's hardware. ### 2. Passphrases (for passwords you must type) For passwords you need to remember — like your computer login or password manager master password — use a passphrase: four or more random words. correct-horse-battery-staple is famously stronger than Tr0ub4dor&3 despite being easier to remember. The key word is random — don't pick words that relate to each other or to you. ✅ The modern approach: Use a password manager for all accounts. Generate random 18+ character passwords for everything. Use a long passphrase only for your master password and computer login. Enable 2FA everywhere that supports it. ## What about password rotation policies? Many organizations still force password changes every 90 days. NIST's latest guidelines (SP 800-63B) now recommend against mandatory periodic rotation unless there's evidence of compromise. Why? Because forced rotation leads to weaker passwords — people just increment a number ( Password1 → Password2 ) or make minimal changes that attackers model anyway. The better policy: use a strong unique password, enable 2FA, and only change it if the service reports a breach. ## The bottom line Stop thinking about complexity. Start thinking about length and randomness. P@ssw0rd! is not a strong password no matter how many rules it satisfies — it's a dictionary word with a handful of predictable modifications. A randomly generated 16-character string or a four-word random passphrase will protect you. A leet-speak substitution will not. Use our password checker to see how your current passwords score, and our generator to create ones that will actually hold up. --- ## PAGE: How to pick a password manager (and which ones we trust) URL: https://passwordstrength.net/blog-password-manager.html Summary: We compare Bitwarden, 1Password, and KeePassXC on security model, price, and usability — so you do not have to. A password manager is the single most impactful security upgrade most people can make. It lets you use a unique, randomly generated strong password for every account without remembering any of them. But with dozens of options available, which should you choose? ## What to look for in a password manager Before comparing products, here are the criteria that matter most: - Security architecture — does the company ever have access to your vault? (They shouldn't.) - Open source / audited — has the code been independently reviewed? - End-to-end encryption — your data should be encrypted locally before syncing - Breach history — has the company been hacked? How did they respond? - Cross-platform — works on all your devices and browsers - Price — free tier vs. paid features ## Our top picks ### 🥇 Bitwarden — Best overall Open-source, independently audited, end-to-end encrypted. Free tier is genuinely useful. You can self-host if you want full control. Trusted by security professionals worldwide. ### 🥈 1Password — Best for families/teams Excellent UX, strong security model, travel mode feature. Not open-source but has been audited. No free tier, but polished apps across all platforms. ### 🥉 KeePassXC — Best offline Fully offline, open-source, stores vault as a local file you control. No subscription, no cloud. Best for privacy-maximalists who manage their own sync. ### ⚠️ Avoid: LastPass Multiple severe breaches in 2022–2023, including theft of encrypted vaults. Their incident response was widely criticized. We recommend migrating away from LastPass. ## The master password question Your password manager master password is the single point of failure — if it's compromised, everything is. Use a strong six-word random passphrase, enable 2FA on your manager account, and store your emergency recovery kit somewhere secure offline. ✅ Our recommendation: Start with Bitwarden — it's free, open-source, and trusted. Install it today, import your existing passwords, then spend a week replacing weak or reused ones with generated random passwords. ## Getting started: a one-week plan - Day 1: Install Bitwarden, set a strong master passphrase, enable 2FA - Day 2–3: Add all your existing accounts - Day 4–5: Change passwords on your five most important accounts to random generated ones - Day 6–7: Work through remaining accounts, prioritizing financial and email --- ## PAGE: 10 password mistakes you're probably still making URL: https://passwordstrength.net/blog-password-mistakes.html Summary: Most people know passwords matter. But knowing and doing are different things. Here are the ten most common password mistakes — and how to fix each one. Most people know passwords matter. But knowing and doing are different things. Here are the ten most common password mistakes — and exactly how to fix each one. ## 1. Reusing passwords across sites The single most dangerous habit. When one site is breached, every account using that password is at risk. Fix: use a password manager to generate and store a unique password per site. ## 2. Using personal information Your name, birthday, pet's name, hometown, or favourite team are all publicly findable. Attackers use this information to make targeted guesses. Fix: use random passwords with no connection to you. ## 3. Making passwords "complex" instead of long P@ssw0rd! is complex but weak. correct-horse-battery-staple is simple but strong. Length beats complexity. Fix: aim for 16+ random characters or 5+ random words. ## 4. Storing passwords in a text file or spreadsheet An unencrypted file on your desktop or in Google Drive is not secure. Fix: use a proper password manager with encryption (Bitwarden, 1Password, KeePass). ## 5. Using SMS for 2FA on important accounts SMS codes can be intercepted via SIM swapping. Fix: switch to an authenticator app for email and financial accounts. ## 6. Never changing breached passwords If a site you use has been breached and you haven't changed that password since, it may be in attacker databases. Fix: check haveibeenpwned.com and change any exposed passwords. ## 7. Using browser-saved passwords without a master password Browser-saved passwords without encryption can be accessed by anyone with physical access to your computer. Fix: use a dedicated password manager with a strong master passphrase, or at minimum set a browser profile password. ## 8. Ignoring "your password was found in a data breach" warnings Chrome, Firefox, and iOS all flag breached passwords. Many people dismiss these warnings. Fix: take them seriously and change the flagged passwords immediately. ## 9. Using short passwords because they're "easier to type" An 8-character password, even fully random, can be cracked in hours with modern hardware. Fix: use a password manager so you never have to type passwords manually. ## 10. Thinking "I have nothing worth stealing" Attackers aren't targeting you personally — they're running automated attacks against millions of accounts simultaneously. Your email account alone gives access to every password reset. Fix: treat every account as worth protecting. ✅ One fix to rule them all: Most of these mistakes disappear when you use a password manager. Install Bitwarden (free), import your passwords, and spend one afternoon replacing weak ones with generated passwords. Problem solved. --- ## PAGE: Password policies for teams: what actually works in 2025 URL: https://passwordstrength.net/blog-password-policies.html Summary: Forced 90-day rotations make passwords weaker, not stronger. We review NIST latest guidance and what enterprise teams should implement instead. Most enterprise password policies were designed in the early 2000s and haven't kept up with what we now know about how people actually behave — and how attackers actually work. Here's what NIST's current guidelines say, and what teams should actually implement. ## What the old policies got wrong Traditional enterprise password policies typically required: 8-character minimum, uppercase + lowercase + number + symbol, mandatory rotation every 60–90 days. This approach had a logical basis, but it failed in practice because it ignored human psychology. When forced to rotate passwords regularly, users don't generate fresh random passwords — they make minimal changes: Password1! becomes Password2! , then Password3! . When required to include symbols, they append ! . When required to remember complex passwords, they write them on sticky notes or reuse them everywhere. ⚠️ NIST now recommends against: Mandatory periodic rotation without evidence of compromise, overly complex composition rules (which lead to predictable patterns), security questions (which are easily guessed or researched), and password hints. ## NIST SP 800-63B: the current standard NIST's current Digital Identity Guidelines (SP 800-63B, updated 2024) recommend: - Minimum 8 characters (with longer being better — allow up to 64+) - Check against breach databases — reject known compromised passwords - No mandatory rotation unless there's evidence of compromise - No complexity rules that lead to predictable patterns - Allow all printable characters including spaces - Require MFA for all users, especially privileged accounts ## What actually works for teams ### ✅ Mandate a password manager Provide an enterprise password manager (1Password Teams, Bitwarden Business) and require its use. This is the single highest-impact policy change you can make. ### ✅ Require MFA everywhere Phishing-resistant MFA (hardware keys or TOTP) on all accounts. Accept no exceptions for "inconvenience." The risk of an account compromise vastly outweighs the friction. ### ✅ Monitor for breached credentials Integrate with Have I Been Pwned's API or an enterprise service to check if employee credentials appear in breach databases and require immediate password changes. ### ✅ Train on phishing recognition Run regular phishing simulations and training. Password strength is irrelevant against a successful phish — recognition is the only defense. ✅ The modern policy in one sentence: Use a password manager for unique random passwords, require MFA on all accounts, monitor for breached credentials, and train employees to recognize phishing. --- ## PAGE: The 2024 RockYou2024 breach: 10 billion passwords in the wild URL: https://passwordstrength.net/blog-rockyou2024.html Summary: The largest credential database ever compiled was leaked. We analyze what it means for password security and how to check if your passwords were exposed. In mid-2024, a file containing nearly 10 billion unique plaintext passwords was leaked on a popular hacking forum. Named RockYou2024, it is the largest compilation of real-world credentials ever publicly released. Here's what it means for you. ## What is RockYou2024? RockYou2024 is a credential compilation — a massive list assembled from thousands of previous data breaches spanning over two decades. It contains approximately 9.9 billion unique plaintext passwords collected from breaches of sites, apps, and services worldwide. It's named after the original RockYou breach of 2009, which leaked 32 million passwords and became the foundation of many dictionary attack wordlists. ⚠️ Important context: RockYou2024 is a compilation of old breaches, not a new breach of a single service. Your current passwords are not necessarily in it — but passwords you've used in the past at any breached service may be. ## Why this matters for password attacks Credential compilations like this are used in two primary attack types: - Credential stuffing — automated tools try username/password combos from the list against other services. If you reused a password, attackers can access your accounts at sites that were never breached. - Dictionary attacks — the passwords become part of wordlists used when cracking hashed password databases from new breaches. The practical impact: if any password you've ever used appears in this list (or any previous breach), and you're still using it anywhere, your account at that service is at risk. ## How to check if you're exposed The most reliable free service to check if your email or passwords appear in known breaches is Have I Been Pwned (haveibeenpwned.com), run by security researcher Troy Hunt. It indexes breach data and lets you check by email or by hashed password — your plaintext password is never transmitted. ## What to do right now - Check your email addresses at haveibeenpwned.com - Change any password flagged as breached immediately - Stop reusing passwords — use a password manager to generate unique passwords per site - Enable 2FA on all accounts, especially email and financial accounts - If you're still using any password from before 2020, consider it potentially compromised ✅ The real lesson: RockYou2024 doesn't change what good security looks like — it just makes the case more urgent. Unique passwords per site and 2FA make credential stuffing attacks useless against you, regardless of what's in breach databases. --- ## PAGE: How to secure your email account: the complete guide URL: https://passwordstrength.net/blog-secure-email.html Summary: Your email is the master key to your digital life. A step-by-step guide to locking it down — strong passwords, 2FA, recovery options and connected apps. Your email account is the master key to your digital life. Reset links for every other account — banking, social media, work tools — flow through it. Securing it properly is the single most impactful thing you can do for your online safety. ## Why email is the #1 target When attackers compromise an email account, they don't just read your messages. They click "Forgot password" on every service you use — bank, PayPal, Amazon, social media — and reset those passwords too. One compromised email cascades into a full account takeover within minutes. Email accounts are also targeted specifically because many people reuse passwords, and email addresses are publicly known (you hand them out constantly). Combine a known username with a reused password from a breach database, and attackers get in without any technical skill at all. ⚠️ Check yourself now: Go to haveibeenpwned.com and enter your email address. If it appears in any breach, your password for that service was exposed — and if you reused it on your email account, change your email password immediately. ## Step 1 — Use a strong unique password Your email password should be at least 16 characters, randomly generated, and used nowhere else. If you have been using the same password for years or across multiple sites, change it today. Use our generator to create one, and store it in a password manager. ## Step 2 — Enable two-factor authentication 2FA is non-negotiable for email. Even if your password is stolen via phishing or a breach, the attacker cannot log in without your second factor. Priority order for 2FA methods: - Hardware security key (YubiKey) — best, phishing-proof - Authenticator app (Google Authenticator, Authy) — strong - SMS codes — better than nothing, but vulnerable to SIM-swap ## Step 3 — Review account recovery options Check what recovery options are set on your account. Recovery phone numbers and backup email addresses are additional attack surfaces. Make sure your recovery email is also secured with a strong password and 2FA. Remove any recovery options you no longer control (old phone numbers, old email addresses). ## Step 4 — Audit connected apps Go to your email provider's security settings and review which third-party apps have access to your account. Revoke access to any apps you no longer use or don't recognise. Each connected app is a potential way in for attackers if that app is compromised. ## Step 5 — Watch for suspicious activity Most email providers show recent login activity — IP addresses, devices, locations. Check this regularly. If you see a login from an unfamiliar location or device, change your password and check your recovery options immediately. ✅ Five-minute action plan: Change to a unique random password → enable authenticator app 2FA → check haveibeenpwned.com → review connected apps → bookmark your provider's recent activity page. --- ## PAGE: SIM swapping attacks: what they are and how to protect yourself URL: https://passwordstrength.net/blog-sim-swapping.html Summary: Criminals convince your carrier to transfer your phone number — then use it to bypass SMS-based 2FA. Here is what to do to protect yourself. SIM swapping — also called SIM hijacking — is an attack where a criminal convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they can intercept SMS-based 2FA codes and reset passwords on any account tied to that number. ## How the attack works Attackers gather personal information about their target — name, address, last four digits of Social Security number, account PIN — often from social media, data brokers, or previous breaches. They call the carrier's customer service, impersonate the victim, claim they lost their phone, and request the number be transferred to a new SIM. Once successful, the attacker receives all SMS messages sent to that number. They then go to your email provider, bank, or crypto exchange, click "Forgot password," and receive the reset code via SMS — directly to their phone. ⚠️ High-profile victims: SIM swap attacks have drained millions from crypto accounts, compromised Twitter/X accounts of public figures, and been used to steal from major executives. The FBI received over 1,600 SIM swap complaints in 2023 alone. ## Why SMS 2FA is vulnerable SMS-based authentication was never designed as a security mechanism — it was designed for convenience. The mobile carrier network (SS7 protocol) has known vulnerabilities, and social engineering of customer service agents bypasses the technical layer entirely. SMS 2FA is better than no 2FA, but it's the weakest form available. ## How to protect yourself - Switch from SMS 2FA to an authenticator app — codes generated on your device can't be intercepted via SIM swap - Use a hardware security key for your most important accounts — completely immune to SIM swapping - Set a carrier PIN or passcode — call your mobile carrier and add an extra PIN required before any account changes - Enable port freeze — some carriers offer this, preventing number transfers without in-person verification - Limit personal info online — the less attackers can find about you, the harder social engineering becomes - Use a separate number for 2FA — a Google Voice or similar number is harder to SIM-swap than a carrier number ✅ Action today: Call your carrier and set an account PIN. Then switch any SMS-based 2FA on your email and financial accounts to an authenticator app. These two steps eliminate most SIM swap risk. ---