Passwords that hold up
Most accounts aren’t broken into by clever hacking. They’re opened with a password that was guessed, or one that leaked from a different site and was tried everywhere else. In this lesson you’ll measure why “complex” passwords are weaker than they look, make one that’s genuinely strong and easy to remember, check whether a password has already leaked, and add the second step that stops most account takeovers.
In this lesson
- Measure a typical “complex” password against a passphrase
- Check safely whether a password has appeared in a breach
- Turn on two-step sign-in, or a passkey, for your email
You’ll need: a phone or computer, and about ten minutes in your email account’s security settings.
How passwords really get cracked
Attackers don’t try every combination of letters one by one. They start with lists of real passwords leaked from past breaches, then apply rules people commonly follow: a capital first letter, a year on the end, @ instead of a, an exclamation mark. That’s why “P@ssw0rd2026!” falls almost at once, even though it ticks every box on a typical sign-up form.
The US standards body NIST now says the same in its official guidance (SP 800-63B, revised in 2025): a password used on its own should be at least 15 characters, websites shouldn’t force a mix of symbols and numbers, they shouldn’t force you to change it on a schedule, and they should check it against lists of known leaked passwords. Length and randomness matter; clever substitutions barely do.
Try it yourself · part 1
Measure two passwords
- Open Password Tools. It runs in your browser, but practise with made-up examples, not your real passwords.
- On the Strength tab, type
P@ssw0rd2026!. It comes out Terrible: the tool spots the word under the symbols and the year on the end, and estimates it would be cracked from a leaked list instantly. - Now type
river-tulip-oven-gravel-moth, five random words. It comes out Strong, at an estimated 15 centuries to crack from a leaked list, and it’s far easier to remember. - Read the lines under each result. They explain which patterns the tool found, and why counting character types alone, the way most strength meters do, overrates passwords like the first one.
Try it yourself · part 2
Make a passphrase
- Switch to the Passphrase tab, choose 5 words or more, and click Generate.
- The words are picked at random from a list of 7,776, and each one adds 12.9 bits of strength, which the tool adds up for you. Randomness is the point: words you choose yourself, like a favourite song lyric, are much easier to guess.
- Use a passphrase like this for the few passwords you need to remember: your email, your password manager, and your phone or computer login. Don’t reuse one you’ve seen on a website, including the examples here.
Try it yourself · part 3
Has a password already leaked?
- Switch to the Breach check tab. Your password is scrambled into a code (a hash) in your browser, and only the first five characters of that code leave the page, so the breach service never learns which password you checked.
- Type a password and click Check.
- Found means that exact password appears in leaked data, so it’s on the lists attackers try first: change it everywhere you use it. Not found only means it hasn’t leaked; it doesn’t make it strong.
One password per site: let something remember them
The single biggest improvement most people can make is to stop using the same password on more than one site. When one site leaks, every account sharing that password is open. Nobody can remember a different strong password for every site, which is what password managers are for: they create a random password for each site, remember it, and fill it in for you. Your phone and browser already have one built in (on iPhone and Mac, the Passwords app; on Android and in Chrome, Google Password Manager), and there are dedicated ones too. A password manager also refuses to fill in your details on a fake site, because the domain doesn’t match: a quiet extra protection against the tricks in Lesson 2.
The second step that stops most takeovers
Two-step sign-in (also called two-factor authentication or 2FA) means a leaked or guessed password isn’t enough on its own: signing in also needs something only you have, like a code from an app on your phone or a tap on a prompt. Passkeys go further: they replace the password with a key stored on your device, and they only work on the real site they were made for, so they can’t be typed into a fake page at all.
Try it yourself · part 4
Protect your email first
- Start with your main email account. Whoever controls your email can reset the password of almost everything else.
- Open its security settings and look for 2-Step Verification, Two-factor authentication or Passkeys. For a Google account, that’s in your Google Account under Security; for a Microsoft account, under Security on your Microsoft account page.
- Turn it on. If you’re offered a passkey or an authenticator app, choose that over text-message codes, but any second step is far better than none.
- Save the backup codes it gives you somewhere safe, offline, in case you lose your phone.
Key takeaways
- Length and randomness beat symbol swaps: five random words beat “P@ssw0rd2026!”.
- Use a different password for every site; a password manager makes that easy.
- Check passwords against breaches; “found” means change it everywhere.
- Turn on two-step sign-in or a passkey, starting with your email.
- Never read out or forward a sign-in code to anyone.
Check yourself
Three questions. Pick one answer each and you’ll see why.
1. Which of these is the strongest password?
2. The breach check says “not found”. What does that tell you?
3. Someone calls from your bank and asks you to read out the code they’ve just sent you “to verify it’s you”. What should you do?
The Password Tools page explains how its estimates work, and why most strength meters overrate passwords.
This lesson is part of the free course Scams and Staying Safe, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.