Password Security Best Practices
The single most effective thing you can do for account security: use a unique, randomly generated password for every account. Reusing passwords is the #1 cause of account breaches. When one site gets hacked, attackers try those credentials everywhere else — a technique called credential stuffing.
Here are the rules that actually matter, based on current research and NIST guidelines:
- Minimum 12 characters, ideally 16+. Length beats complexity. A 16-character lowercase-only password (entropy: 75 bits) is harder to crack than an 8-character password with every character type (entropy: 52 bits).
- Use a password manager. 1Password, Bitwarden, or Apple Keychain. Generate and store a unique password for every account. You only need to memorize one master password.
- Enable two-factor authentication (2FA). Even a strong password can be phished. 2FA with an authenticator app (not SMS) adds a second layer that survives credential theft.
- Never share passwords over email or text. Use your password manager's secure sharing feature, or share through an encrypted channel.
- Stop changing passwords on a schedule. NIST SP 800-63B explicitly recommends against forced periodic changes. Change passwords only when you suspect compromise.
How Password Entropy Works
Entropy measures the randomness (unpredictability) of a password in bits. The formula is simple: entropy = length × log²(pool size). A password using 95 printable ASCII characters (26 uppercase + 26 lowercase + 10 digits + 33 symbols) at 16 characters long has 16 × 6.57 = 105 bits of entropy.
Each additional bit of entropy doubles the number of possible passwords. A 60-bit password has 2&sup6;&sup0; (about 1.15 quintillion) possible combinations. At 10 billion guesses per second — a realistic rate for modern GPU-based attacks — that takes roughly 36 years to exhaust. At 105 bits, the time exceeds the age of the universe.
Entropy Thresholds
| Entropy (bits) | Strength | Example | Crack Time (10B guesses/sec) |
|---|---|---|---|
| < 28 | Weak | 4-char numeric PIN | Instant |
| 28 – 35 | Fair | 6-char lowercase | Seconds to minutes |
| 36 – 59 | Strong | 10-char mixed case + numbers | Hours to years |
| 60+ | Very Strong | 16-char all character types | Millions to billions of years |
NIST Password Guidelines (SP 800-63B)
The National Institute of Standards and Technology updated its password recommendations in 2024 with significant changes from older guidelines. The key takeaways for individuals:
- Minimum 8 characters, recommended 15+. NIST sets the floor at 8, but acknowledges longer is significantly better. Service providers should support up to at least 64 characters.
- No composition rules required. Forcing uppercase + number + symbol leads to predictable patterns like "Password1!". Let users choose any characters they want — length matters more than forced complexity.
- No periodic password changes. Mandatory rotation causes users to make minimal, predictable changes (Password1 → Password2). Change only when there is evidence of compromise.
- Screen against breached password lists. Before accepting a new password, check it against known breached password databases (like Have I Been Pwned). A "strong" password that appears in a breach list is worthless.
- Allow paste into password fields. Blocking paste prevents password managers from filling credentials, which discourages their use. Always allow paste.
Character Pool Size by Type
| Characters Included | Pool Size | Bits per Character | 12-char Entropy |
|---|---|---|---|
| Lowercase only (a-z) | 26 | 4.70 | 56.4 bits |
| Lower + upper (a-zA-Z) | 52 | 5.70 | 68.4 bits |
| Lower + upper + digits | 62 | 5.95 | 71.5 bits |
| All types + symbols | 88 | 6.46 | 77.5 bits |
| All printable ASCII | 95 | 6.57 | 78.8 bits |
Common Password Attacks
- Brute force: Try every possible combination. Entropy determines how long this takes. A truly random 16-character mixed password is immune to brute force with current technology.
- Dictionary attacks: Try common words, names, and known passwords. "Sunshine2024!" feels strong but appears in breach lists. Random generation avoids this entirely.
- Credential stuffing: Reuse stolen username/password pairs from one breach on other sites. Unique passwords per site neutralize this attack completely.
- Phishing: Trick users into entering passwords on fake sites. No password strength protects against this — use 2FA and verify URLs before entering credentials.
- Rainbow tables: Precomputed hash lookups for common passwords. Proper salting by services defeats this, but random passwords add defense in depth.
When to Exclude Ambiguous Characters
Characters like I, l, 1, O, and 0 look identical in many monospace fonts. Exclude them when you need to read a password aloud, type it manually from a screen, or share it on paper (Wi-Fi passwords, temporary access codes). For passwords stored in a password manager, keep ambiguous characters — they increase the character pool and entropy.
Need a random number for a raffle, lottery pick, or simulation? Use our random number generator for quick, unbiased number selection with customizable range and count.