Passphrases and Password Managers: Your First Real Defence

Length beats cleverness

Each additional character multiplies the search space an attacker must cover. An eight-character password with mixed case and symbols has roughly a thousand trillion possibilities, impressive until a GPU farm clears it in hours. A random fifteen-character passphrase pushes past numbers with thirty digits, which no earthly hardware brute-forces within a human lifetime.

That's why the strongest practical pattern is the passphrase: four or more unrelated words strung together, like 'copper-lantern-drifts-midway'. It's long, it's random if you choose words randomly, and, unlike 'Xk9!pQ2#', you can actually remember it while typing on a phone.

• Pick words from a list or generator at random; human-chosen 'random' words cluster badly (pet names, sports teams, curse words).
• Avoid famous quotes, song lyrics and movie lines, their word sequences appear in cracking dictionaries.
• Adding a digit or symbol doesn't hurt, but treat it as seasoning, not structure.

Uniqueness contains the damage

Credential stuffing, replaying leaked username/password pairs against hundreds of other sites, is the most common attack on the modern web. Its success depends entirely on one habit: reuse. If every account has its own password, a breach at a knitting forum costs you a knitting-forum account. With reuse, it costs you your bank.

You cannot maintain 150 unique random secrets mentally. Nobody can. That limitation, not technology, is why password managers became standard security practice rather than a geek accessory.

Choosing and adopting a password manager

A password manager is an encrypted vault unlocked by one strong master passphrase. Reputable options encrypt locally on your device before anything syncs, meaning even the vendor cannot read your vault. Open-source choices such as Bitwarden or KeePassXC allow independent audits; commercial ones add polished apps and breach alerts.

1. Install a reputable manager in your browser and phone, protected by a long master passphrase (this one you memorize).
2. Import existing passwords or add accounts as you log in over the next two weeks, no marathon session needed.
3. Use the built-in generator everywhere: 16+ characters for high-value accounts, or a generated passphrase when you must type it manually.
4. Replace any password flagged as reused or appearing in breach corpora, starting with email and finance.
5. Store recovery codes offline on paper; a vault locked forever helps nobody.

Test, don't guess

Strength feels subjective but is measurable. Our Password Exposure Checker estimates entropy and realistic crack time locally in your browser, then checks whether your password already appears in known leak compilations using k-anonymity, only a tiny fragment of its hash ever leaves your device. Run your current favourites through it before trusting them anywhere.

Common objections, answered

• "What if the manager gets hacked?" Vault databases are designed for exactly that scenario, strongly encrypted, keyed to your master passphrase. Real-world incidents have shown the practical risk lands on weak master passphrases, not the model itself.
• "Isn't one password risky?" One excellent, unique, MFA-protected passphrase is safer than 150 reused mediocre ones. Add hardware-key protection on the vault for belt-and-suspenders.
• "Paper is safer." Paper resists remote attackers but burns, floods and can't autofill. A written emergency backup stored offsite is sensible; paper-only daily use quietly breeds reuse again.