All too often I’m presented with the following “rules” selecting a new password for a website or service: –
Your password must have…
- At least 8 characters
- At least 1 number
- At least 1 uppercase letter
- At least 1 special character
None of these rules make a secure password. It’s the length of a password more than its complexity that makes it secure. According to Hive Systems, an 8-character password with a mix of letters, numbers, and symbols could be cracked in about 11,000 years—but by simply increasing it to 15 lowercase characters, it could take 477 million years. And an 18 character lowercase-letter-only password would take 6 trillion years.
The key takeaway? Your password doesn’t need random characters to be strong — it just needs to be long and unique. The other advantage to just using letters is that it’s easy to remember. This xkcd article sums that fact up perfectly:-
Password Strength by Randall Munroe, xkcd.com, used under the CC BY-NC 2.5 licence.