What really makes a password strong.
Not the exclamation mark at the end. Not the zero instead of the letter O. Length does, and the fact that it is used nowhere else.
Why the old rules never worked.
For decades the rule was: at least eight characters, one capital letter, one digit, one special character, changed every ninety days. The result was the same pattern everywhere. Summer became Summer2024, Summer2024 gained an exclamation mark, and at the next change somebody counted up by one. Attackers know this pattern better than the policies that produced it. That is why Germany's Federal Office for Information Security no longer recommends scheduled changes either, but long passwords that are changed only when there is a reason.
Length beats complexity.
Every character multiplies, several times over
One more character multiplies the number of possibilities. A special character in a fixed position barely adds anything, because attackers try exactly that position first.
Four words beat eight characters
Four randomly chosen words in a row are longer, easier to remember and harder to guess than anything cryptic with eight places. What matters is that the words really are chosen at random and do not add up to your favourite quotation.
The figures that apply today
For the one master password you commit to memory: at least twenty characters, or four to five random words. For every other account: generated by the manager, long and random, and never used twice.
The most important point is not in the rules
A perfect password used at ten services is weaker than ten mediocre ones that each appear only once. Reuse is the real problem, not the choice of characters.
How you actually remember one.
You need exactly one password in your head, the one for the vault. Take four words that have nothing to do with each other and tie them into an image that makes sense only to you. The more absurd it is, the better it sticks. What you should avoid: names of family members or pets, dates of birth, your street name, your favourite song. All of that sits in social networks and is tried first. Write the finished password down once, on paper, until it is settled in your memory, and keep that note at home rather than at your desk at work. A note in a drawer at home is safer than a weak password in your head.
Common questions. Clear answers.
Your question is not here? Write to us, we answer personally.
How long does a password need to be today?
For the master password of your vault, at least twenty characters and preferably more, or four to five randomly chosen words. For every other account the length no longer concerns you, because the manager creates and enters it. There, twenty random characters are the sensible default.
Should I change my passwords regularly?
No, not without a reason. Forced changes demonstrably lead to weaker passwords, because people then count upwards. Change a password when a service reports a breach, when you have used it twice, or when you suspect that somebody knows it.
Are special characters pointless?
Not pointless, only overrated. Special characters distributed at random within a long password do help. An exclamation mark at the end because the form insists on one helps almost not at all, because that is precisely what everybody does and attackers try it first.
What about passkeys, will I still need passwords?
Passkeys are replacing the password at a growing number of services and are the better solution there, because nothing can be intercepted. They are simply not supported everywhere yet. Until then you need both, and a vault manages both in one place.
May I write my password down?
For the one master password, yes, provided the note stays at home rather than at your desk at work. The most common attack comes over the network, not out of your drawer. For every other account the question does not arise, because you never need to know them.
Enterprise Security. No Compromise.
Register for our next free, no-obligation live webinar and see how FidenoVault protects your logins.
- Zero-knowledge
- European sovereignty
- GDPR-compliant
