Password Security Guides
Everything about passwords in one place: how to build strong ones, how attackers break weak ones, how to manage hundreds without losing your mind - And what comes after passwords entirely.
- Learn the basics - Start with creating a strong password.
- Know your enemy - See how passwords actually get cracked.
- Get organized - Decide with the password manager guide.
- Lock it down - Finish with the 2FA setup guide.
How to Create a Strong Password in 2026
Length beats cleverness. Here is how to build passwords that survive modern GPU cracking rigs - With real entropy math, NIST's current rules, and the habits that matter more than symbols.
Read the guidePassword Fundamentals
What makes a password strong, how randomness works, and how to build passwords you can trust.
How to Create a Strong Password in 2026
Length beats cleverness. Here is how to build passwords that survive modern GPU cracking rigs - With real entropy math, NIST's current rules, and the habits that matter more than symbols.
Password Entropy Explained: Bits, Math and Real Crack Times
Entropy is the one number that predicts how long a password survives an attack. Here's the math behind bits, why 40 bits falls in minutes while 80 bits outlives the attacker, and how hashing changes everything.
What Is a Passphrase? Diceware and Word-Based Passwords
A passphrase is a password built from randomly chosen words - Easy for humans, brutal for cracking rigs. Here's the Diceware method, the math, and when words beat random characters.
How Random Password Generators Actually Work (CSPRNG)
A password generator is only as good as its randomness. Here's how CSPRNGs gather entropy, why Math.random() is dangerous, what modulo bias is, and the historic failures that prove it all matters.
The Most Common Passwords - And Why They Fail in Seconds
Year after year, 123456 and password top the leak charts. Here's what the breach data shows people actually choose, how attackers exploit those lists, and why "common" means "cracked instantly.
How Long Should a Password Be? The Data Behind 16+
Length is the single biggest lever you control over password strength. Here's what the crack-time data actually shows, why 8 characters died years ago, and why 16 random characters is the modern floor.
Password Ideas That Are Actually Strong (and What to Avoid)
Most "password ideas" lead straight to guessable passwords. Here are the methods that actually hold up - Passphrases, the sentence trick, 10 strong structures - And the traps to skip.
Are Online Password Generators Safe to Use?
Online password generators can be perfectly safe - Or a quiet risk. Here's the difference between client-side and server-side tools, and how to verify one yourself in about a minute.
Attacks & Breaches
How passwords actually get cracked, stolen and abused - And what to do when it happens.
How Hackers Crack Passwords: Brute Force, Dictionaries and Rainbow Tables
A plain-English tour of how password cracking actually works - Brute force, dictionary attacks, hybrid rules and rainbow tables - And what genuinely stops each one.
Credential Stuffing: Why One Reused Password Sinks Every Account
Credential stuffing turns one breached password into a skeleton key for your whole digital life. Here's how the attack works at industrial scale - And how to make it useless against you.
Phishing Protection: How to Spot Password-Stealing Scams
Phishing steals more passwords than any cracking rig ever will. Learn the tells of fake login pages, the tricks that beat even careful people, and the defenses that make phishing fail.
Your Password Was in a Data Breach - Do This Now
A calm, ordered checklist for the moment you learn your password leaked: what to change first, what can wait, and how to make sure one breach doesn't cascade into ten.
Password Statistics 2026: 50+ Facts About Our Password Habits
More than 50 sourced statistics on passwords in 2026 - Breach costs, the most common passwords, reuse habits, phishing speed, 2FA adoption and the rise of passkeys.
Keyloggers: How They Steal Passwords and How to Stop Them
A keylogger records every keystroke you type - Including the world's strongest password. Here's how software and hardware keyloggers work, how they get onto machines, and the defenses that actually neutralize them.
Password Management
Storing, organising and sharing credentials safely, at home and at work.
Do You Need a Password Manager? A Complete Guide
Password managers solve a math problem your memory can't: hundreds of accounts, each needing a unique random password. Here's how they work, who genuinely needs one, and how to choose.
Password Policy Best Practices for Businesses (NIST-Aligned)
NIST SP 800-63B retired forced rotation and composition rules years ago, yet most corporate policies still enforce both. Here's a modern, NIST-aligned password policy you can adopt today.
How Often Should You Change Your Password? (The Answer Changed)
The 90-day password change rule is dead - NIST, Microsoft and the NCSC all retired it. The new answer: change passwords on evidence of compromise, and make each one strong enough to never need a schedule.
How to Share a Password Safely (and How Not To)
Sooner or later you'll need to hand someone a password - Wi-Fi, streaming, a family account, a work login. Here's the ranking of sharing methods from worst to best, and how to revoke access cleanly.
The 15-Minute Password Hygiene Checklist
You don't need a security overhaul weekend. Fifteen focused minutes - Breach check, email and bank lockdown, 2FA, and a plan for the reused stragglers - Fixes the failures that actually get accounts hijacked.
2FA & Beyond
Two-factor authentication, TOTP, passkeys and the future after passwords.
Two-Factor Authentication: The Complete Setup Guide
What two-factor authentication actually protects you from, which second factor to pick, and a step-by-step plan for turning it on everywhere that matters - Without locking yourself out.
TOTP vs SMS 2FA: Which Second Factor Should You Trust?
SMS codes and authenticator apps both add a second factor, but they fail very differently. SIM swapping, SS7 attacks, and NIST's guidance explain why TOTP wins almost every time.
Passkeys Explained: Life After Passwords
Passkeys replace passwords with device-bound cryptographic keys that can't be phished, guessed, or leaked in a breach. Here's how WebAuthn works and where adoption really stands in 2026.
2FA Backup Codes: Your Break-Glass Plan
Backup codes are the recovery plan most people skip when they turn on 2FA. Here's what they are, where to store them, and how to make sure a lost phone never becomes a lost account.
Encryption & Hashing
The cryptography that protects your passwords, explained in plain English.
AES-256 Encryption Explained Simply
AES-256 protects everything from your WiFi to state secrets, yet the idea behind it is simple: scramble data in rounds with a 256-bit key so large that brute force is physically impossible.
Password Hashing: MD5 vs SHA-256 vs bcrypt
Hashing is how sites store passwords without storing passwords. But MD5, SHA-256, and bcrypt are wildly different tools - And using the fast ones for passwords is how breaches become catastrophes.
Salts and Peppers: The Seasoning That Protects Passwords
A salt is a random value added to each password before hashing; a pepper is a secret kept out of the database entirely. Here's how the two work, why they exist, and what happens when sites skip them.
Platform How-Tos
Step-by-step password change and reset guides for every major platform and device.
Guide Questions, Answered
Where should a complete beginner start?
How often are these guides updated?
Are the guides written by AI or by people?
Do I need to read them in order?
Put it into practice
Generate a strong password now, or store your credentials in the free encrypted Password Wallet.