Password generator

Why passwords get cracked

A password is rarely guessed. It is usually brute-forced or taken from a leak. Three things help attackers:

• Short and simple passwords. Combinations like 123456, qwerty or a name plus a birth year are tried in seconds — that is where an attack starts.
• Database leaks. When a service is breached, its users’ logins and passwords end up in the open.
• One password for everything. If a password leaks from one site, it is immediately tried on email, social networks and banks. That trick is called credential stuffing.

What a strong password looks like

Length matters most. Every extra character multiplies the number of combinations, so 16 random characters are far stronger than 8, even “clever” ones.

• At least 12 characters, and 16 or more is better.
• Different character types: lower and upper case, digits and symbols.
• No personal details: name, birth date, a pet’s name, a phone number.
• A unique password for every service, so a leak on one site does not open the rest.

How long a brute-force attack takes, depending on length and character set:

If you need a password that is easy to remember, use a passphrase of 4–5 random words, for example “cherry-tram-cloud-friday”. It is long, so it is strong, and easier to remember than a string of symbols.

Where to keep passwords

Nobody can remember dozens of unique passwords, and nobody should. A password manager stores them encrypted, fills them in on sites and creates new ones. You only have to remember one master password.

• Do not keep passwords in notes, chats with yourself, screenshots or on sticky notes.
• Do not save passwords in the browser on shared or someone else’s computer.
• Make the master password the longest one — it is the key to all the others.

Two-factor authentication

Two-factor authentication is a second lock: besides the password, sign-in needs a one-time code. Even if the password is stolen, the account stays closed without the code.

• Turn it on first for email, banks, marketplaces and social networks — email is how people recover everything else.
• An authenticator app is safer than SMS: the codes are created on the phone and cannot be intercepted by reissuing the SIM card.
• Save the backup codes somewhere safe — you will need them if you lose the phone.

How to spot phishing

Phishing is fake emails, messages and sites that try to steal passwords, codes and card details. The fakes can look convincing, so watch for the signs:

• Urgency and threats: “your account will be blocked in an hour”, “confirm the payment right now”.
• A strange site address — an extra letter, a different domain, a long link instead of the address you know.
• A request for an SMS code or a password. Real banks and services never ask for those by phone or in a chat.
• An offer that is too good — a prize, a huge discount, a “compensation”.

Staying safe on public Wi-Fi

Open networks in cafés, airports and hotels are convenient, but risky: traffic can be intercepted, and attackers sometimes set up fake hotspots with similar names.

• Ask the staff for the exact network name and do not join lookalikes.
• Turn off automatic connection to open networks.
• Check that the address starts with https and shows a lock.
• Do not enter card details or bank passwords on an open network without a protected connection.

Updates and device protection

Updates close the holes phones and computers get broken into through. The longer a device stays unpatched, the more known holes it still has.

• Turn on automatic updates for the system, the browser and apps.
• Install apps only from the official stores.
• Set a screen lock — a code, a fingerprint or face recognition.
• Do not grant extra permissions: a flashlight does not need your contacts.

What to do if a password leaks

If a service reports a breach, or someone else’s activity shows up in the account, act at once:

• Change the password on that site and everywhere you reused it.
• Turn on two-factor authentication if it is not on yet.
• Sign out every active session in the account settings.
• Check email: look for a new forwarding rule or someone else’s recovery address.
• If a card was saved in the account, review the charges and reissue the card if you need to.

You do not have to rotate passwords on a schedule. Current guidance is to change them after a leak or suspicious activity, and otherwise just use long unique passwords.

Checklist: 10 rules for a safer internet

1. A password of at least 12–16 characters
2. A unique password for every service
3. Passwords live in a password manager
4. Two-factor authentication on email and the bank
5. SMS codes are never shared
6. Links in emails stay unopened — open the site directly
7. On public Wi-Fi, only a protected connection
8. The system and apps update automatically
9. Apps come only from official stores
10. After a leak, the password changes everywhere at once