Cyber Security Passwords and Best Practices

Strong password practices reduce the chance that a guessed, reused, or leaked password gives an attacker access to your accounts.

What Makes a Password Weak

  • Too short, giving an attacker fewer combinations to search through.
  • Based on dictionary words, which automated cracking tools check first.
  • Built from personal information — birthdays, pet names, addresses — that's often easy to find online.
  • Reused across multiple sites, so one leaked password unlocks several accounts.
  • Following predictable patterns, like a common word followed by a digit and a symbol.

Length Beats Complexity

Modern password guidance (including from bodies like NIST) leans toward long passphrases rather than short strings crammed with symbols. A passphrase built from several unrelated random words is both longer and easier to remember than a short, symbol-heavy password, while offering a far larger space of possibilities for an attacker to search through — length has an outsized effect on how hard a password is to brute-force compared to swapping a letter for a symbol.

StyleExample patternMemorabilityResistance to guessing
Short and 'complex'A common word plus digits and a symbolHard to recall, easy to forget the exact substitutionWeaker than it looks — attackers check these patterns first
Long passphraseSeveral unrelated random words strung togetherEasier to recall as a phraseMuch stronger, simply due to length

The Reuse Problem

Credential stuffing is an attack where criminals take username-and-password lists leaked from one breached site and try them against many other sites, betting that people reuse passwords. Because password reuse is extremely common, this simple, automated approach works far more often than it should — meaning a breach at one unrelated service can quietly cascade into account takeovers everywhere else you used the same password.

Password Managers

A password manager generates and stores a long, random, unique password for every single account, locked behind one strong master password or passphrase that only you know. Instead of memorizing (or reusing) dozens of passwords, you only need to remember one — and every account gets a password that's both stronger and impossible to accidentally reuse elsewhere.

  1. Use a unique password for every account — no exceptions for 'unimportant' ones.
  2. Use a password manager to generate and store them.
  3. Enable multi-factor authentication wherever it's offered.
  4. Avoid personal information that's easy to look up or guess.
  5. Change a password quickly after any breach notification involving that account.
  6. Never share passwords over email, chat, or any other unencrypted channel.
Note: Password strength alone doesn't protect against phishing — a convincing fake login page will happily accept even a perfectly strong, unique password, because the user is handing it directly to the attacker. Checking the actual URL before typing a password, and relying on MFA as a backstop, matter just as much as password quality.
Note: Reputable breach-notification services (such as Have I Been Pwned) let you check whether an email address has appeared in a known data breach, which is a useful signal for when it's time to rotate a password rather than waiting until something goes wrong.

Keep Going

Cyber Security Interview QuestionsPractice real questions asked for Cyber SecurityCybersecurity Analyst SalarySee what Cybersecurity Analyst roles pay in the marketAuto Apply for JobsApply to open roles related to Cyber Security and tweak your resume