Password Security Guides

How to Create a Strong Password in 2026

Length beats cleverness. Here is how to build passwords that survive modern GPU cracking rigs - With real entropy math, NIST's current rules, and the habits that matter more than symbols.

Password Entropy Explained: Bits, Math and Real Crack Times

Entropy is the one number that predicts how long a password survives an attack. Here's the math behind bits, why 40 bits falls in minutes while 80 bits outlives the attacker, and how hashing changes everything.

What Is a Passphrase? Diceware and Word-Based Passwords

A passphrase is a password built from randomly chosen words - Easy for humans, brutal for cracking rigs. Here's the Diceware method, the math, and when words beat random characters.

How Random Password Generators Actually Work (CSPRNG)

A password generator is only as good as its randomness. Here's how CSPRNGs gather entropy, why Math.random() is dangerous, what modulo bias is, and the historic failures that prove it all matters.

The Most Common Passwords - And Why They Fail in Seconds

Year after year, 123456 and password top the leak charts. Here's what the breach data shows people actually choose, how attackers exploit those lists, and why "common" means "cracked instantly.

How Long Should a Password Be? The Data Behind 16+

Length is the single biggest lever you control over password strength. Here's what the crack-time data actually shows, why 8 characters died years ago, and why 16 random characters is the modern floor.

Random vs Memorable Passwords: Which to Use Where?

Random character strings and memorable passphrases both have a place - But not the same place. Here's the decision framework: what to generate, what to memorize, and why "clever" human passwords lose to both.

Password vs PIN vs Passphrase: What's the Difference?

Passwords, PINs, and passphrases look like three strengths of the same thing - They're not. Each is built for a different threat model, and using the right one in the right place matters more than raw length.

Do Symbols Really Make Passwords Stronger?

Special characters add less strength than almost everyone believes - And the way most people use them adds almost none. The real math on symbols, where they help, where they're theater, and what to do instead.

10 Password Myths That Refuse to Die

Change it every 90 days, never write it down, symbols make it strong - Much of what everyone "knows" about passwords is outdated or was never true. Ten stubborn myths, tested against current evidence and standards.

Password Ideas That Are Actually Strong (and What to Avoid)

Most "password ideas" lead straight to guessable passwords. Here are the methods that actually hold up - Passphrases, the sentence trick, 10 strong structures - And the traps to skip.

Are Online Password Generators Safe to Use?

Online password generators can be perfectly safe - Or a quiet risk. Here's the difference between client-side and server-side tools, and how to verify one yourself in about a minute.

Attacks & Breaches

How passwords actually get cracked, stolen and abused - And what to do when it happens.

Try: Password Strength Checker

How Hackers Crack Passwords: Brute Force, Dictionaries and Rainbow Tables

A plain-English tour of how password cracking actually works - Brute force, dictionary attacks, hybrid rules and rainbow tables - And what genuinely stops each one.

Credential Stuffing: Why One Reused Password Sinks Every Account

Credential stuffing turns one breached password into a skeleton key for your whole digital life. Here's how the attack works at industrial scale - And how to make it useless against you.

Phishing Protection: How to Spot Password-Stealing Scams

Phishing steals more passwords than any cracking rig ever will. Learn the tells of fake login pages, the tricks that beat even careful people, and the defenses that make phishing fail.

Your Password Was in a Data Breach - Do This Now

A calm, ordered checklist for the moment you learn your password leaked: what to change first, what can wait, and how to make sure one breach doesn't cascade into ten.

Password Statistics 2026: 50+ Facts About Our Password Habits

More than 50 sourced statistics on passwords in 2026 - Breach costs, the most common passwords, reuse habits, phishing speed, 2FA adoption and the rise of passkeys.

9 min read Read →

Keyloggers: How They Steal Passwords and How to Stop Them

A keylogger records every keystroke you type - Including the world's strongest password. Here's how software and hardware keyloggers work, how they get onto machines, and the defenses that actually neutralize them.

Social Engineering: Hacking Humans Instead of Systems

Most breaches don't start with broken code - They start with a persuaded person. Here's how pretexting, baiting, vishing, and urgency scams work, and the habits that make you a hard target.

Dictionary Attacks: Why Real Words Fail Fast

A dictionary attack skips the brute-force slog and guesses what humans actually pick: words, names, and their predictable decorations. Here's how wordlists and mangling rules work - And how to be absent from them.

Rainbow Tables Explained (and Why Salts Killed Them)

Rainbow tables let attackers precompute password cracking once and reuse it forever - Until salting broke the trick. How the time-memory trade-off works, why it mattered, and what its defeat teaches about modern password storage.

Password Spraying: The Slow, Quiet Cousin of Brute Force

Password spraying flips brute force on its head - A few common passwords tried against thousands of accounts, slowly enough to dodge every lockout alarm. Here's how it works and how to make it fail.

Password Management

Storing, organising and sharing credentials safely, at home and at work.

Try: Password Wallet

Do You Need a Password Manager? A Complete Guide

Password managers solve a math problem your memory can't: hundreds of accounts, each needing a unique random password. Here's how they work, who genuinely needs one, and how to choose.

Password Policy Best Practices for Businesses (NIST-Aligned)

NIST SP 800-63B retired forced rotation and composition rules years ago, yet most corporate policies still enforce both. Here's a modern, NIST-aligned password policy you can adopt today.

8 min read Read →

How Often Should You Change Your Password? (The Answer Changed)

The 90-day password change rule is dead - NIST, Microsoft and the NCSC all retired it. The new answer: change passwords on evidence of compromise, and make each one strong enough to never need a schedule.

How to Share a Password Safely (and How Not To)

Sooner or later you'll need to hand someone a password - Wi-Fi, streaming, a family account, a work login. Here's the ranking of sharing methods from worst to best, and how to revoke access cleanly.

The 15-Minute Password Hygiene Checklist

You don't need a security overhaul weekend. Fifteen focused minutes - Breach check, email and bank lockdown, 2FA, and a plan for the reused stragglers - Fixes the failures that actually get accounts hijacked.

How to Remember Strong Passwords (Without Sticky Notes)

The trick isn't memorizing 150 strong passwords - It's memorizing three, and making those three genuinely unforgettable. Passphrases, mnemonic sentences and spaced repetition, minus the sticky notes.

Is It Safe to Save Passwords in Your Browser?

Chrome, Safari, Edge and Firefox all offer to remember your passwords - And the honest answer is "safer than reuse, weaker than a real vault." Here's how browser storage actually works and where it breaks.

Why a Password Spreadsheet Is a Time Bomb

That passwords.xlsx file feels organized and harmless. It's plaintext sitting exactly where malware looks first, synced to places you forgot, with a version history you can't fully delete. Here's the damage math - And the one-hour exit.

Password Management for Families (Kids to Grandparents)

One household now runs on hundreds of logins - Kids' school portals, shared streaming, grandma's banking. How to organize family passwords with shared vaults, emergency access and age-appropriate rules that actually stick.

2FA & Beyond

Two-factor authentication, TOTP, passkeys and the future after passwords.

Try: 2FA Code Generator Try: 2FA API

Two-Factor Authentication: The Complete Setup Guide

What two-factor authentication actually protects you from, which second factor to pick, and a step-by-step plan for turning it on everywhere that matters - Without locking yourself out.

TOTP vs SMS 2FA: Which Second Factor Should You Trust?

SMS codes and authenticator apps both add a second factor, but they fail very differently. SIM swapping, SS7 attacks, and NIST's guidance explain why TOTP wins almost every time.

Passkeys Explained: Life After Passwords

Passkeys replace passwords with device-bound cryptographic keys that can't be phished, guessed, or leaked in a breach. Here's how WebAuthn works and where adoption really stands in 2026.

2FA Backup Codes: Your Break-Glass Plan

Backup codes are the recovery plan most people skip when they turn on 2FA. Here's what they are, where to store them, and how to make sure a lost phone never becomes a lost account.

Hardware Security Keys: YubiKey & Friends Explained

Hardware security keys are the strongest second factor money can buy - A small USB or NFC device that makes phishing mathematically pointless. Here's how they work and how to pick one.

Authenticator Apps Compared: Google, Authy, Microsoft & More

Every authenticator app generates the same six-digit TOTP codes - What differs is backup, sync, lock protection and export. Here's how the major apps compare and which one fits you.

OTP, HOTP, TOTP: A Field Guide to One-Time Codes

OTP is the family, HOTP counts events, TOTP watches the clock. A plain-English tour of how one-time codes are generated, why they expire, and where each variant is used.

Fingerprints and Face Unlock: How Biometric Auth Really Works

Your fingerprint never leaves your phone, and your face isn't stored as a photo. How biometric authentication actually works, where it's strong, where it fails, and what it never replaces.

Encryption & Hashing

The cryptography that protects your passwords, explained in plain English.

Try: AES-256 Tool Try: SHA-256 Hash

AES-256 Encryption Explained Simply

AES-256 protects everything from your WiFi to state secrets, yet the idea behind it is simple: scramble data in rounds with a 256-bit key so large that brute force is physically impossible.

Password Hashing: MD5 vs SHA-256 vs bcrypt

Hashing is how sites store passwords without storing passwords. But MD5, SHA-256, and bcrypt are wildly different tools - And using the fast ones for passwords is how breaches become catastrophes.

Salts and Peppers: The Seasoning That Protects Passwords

A salt is a random value added to each password before hashing; a pepper is a secret kept out of the database entirely. Here's how the two work, why they exist, and what happens when sites skip them.

End-to-End Encryption in Plain English

End-to-end encryption means only the sender and recipient can read a message - Not the app, not the server, not anyone in between. Here's how it actually works and where its limits are.

Zero-Knowledge Architecture: Trust Math, Not Companies

Zero-knowledge architecture means a service stores your data but can never read it - Keys are derived on your device and never leave it. Here's how vaults pull that off and what it means when things go wrong.

What the Padlock Means: HTTPS and TLS Explained

The padlock in your browser means TLS is encrypting the connection - But not that the site is trustworthy. Here's what actually happens in a TLS 1.3 handshake and what the padlock does and doesn't promise.

Platform How-Tos

Step-by-step password change and reset guides for every major platform and device.

Try: Password Generator Try: PIN Generator

How to Change Your Google Password (2026 Guide)

Step-by-step instructions for changing your Google password on the web and in the mobile app, recovering a forgotten one, and locking the account down afterward with 2FA and a session sign-out.

How to Change Your Facebook Password (2026 Guide)

How to change your Facebook password through Meta Accounts Center on the web or in the app, reset a forgotten one, and clean up sessions, 2FA, and connected logins afterward.

How to Change Your Instagram Password (2026 Guide)

The current steps to change your Instagram password through Meta Accounts Center on web and in the app, reset it when forgotten, and secure the account with session sweeps and 2FA.

How to Change Your TikTok Password (2026 Guide)

How to change your TikTok password in the app and on the web, handle the verification-code step, reset a forgotten login, and secure the account with device management and 2FA.