Most advice about passwords sounds impossible to follow: use long random strings, never reuse them, change them often. People give up and use their phone number or their child’s name with “123” at the end. There is a better middle ground. You can create passwords that are strong enough to resist guessing and still easy to remember, and you can stop memorising most of them altogether.
What makes a password weak
Attackers do not sit and type guesses one by one. They use software that tries millions of combinations, starting with the most common passwords, dictionary words, names, dates and keyboard patterns like “qwerty”. Passwords leaked from one website are also tried on others. So a password is weak if it is short, predictable, personal or used somewhere else.
Length beats complexity
A long password made of several unrelated words is harder to crack than a short one full of symbols. “Tr0ub!e” looks clever but is short. A passphrase such as “mango river bicycle window” is long, easy to picture and far stronger. You can add a number or symbol between the words if a site insists, but length does most of the work. Aim for at least 12 to 16 characters.
A simple method to build a passphrase
- Pick four or five random, unrelated words. Do not use a famous phrase or song lyric.
- Picture a silly scene that connects them. The odder the image, the easier it is to remember.
- Join the words with a separator such as a dash or a full stop.
- Add one number that means nothing to anyone else.
Avoid names of family members, birthdays, your phone number, your city or your favourite team. These are the first things attackers try.
Never reuse your important passwords
Reuse is the biggest single risk. When a small website is breached, attackers try the same email and password on email providers, social networks and payment apps. Your email password in particular must be unique, because whoever controls your email can reset almost everything else.
Let a password manager remember the rest
You cannot memorise a different strong password for every account, and you do not need to. A password manager stores them in an encrypted vault protected by one strong master passphrase. Phones already include one: Google Password Manager on Android and iCloud Keychain on iPhone. Let it generate random passwords for sites you rarely use, and memorise only two or three passphrases: your phone lock, your email and the password manager itself.
Add a second layer
Even a strong password can be stolen through a fake login page. Turn on two-step verification for email and messaging apps so that a stolen password alone is not enough to get in.
When you forget a password
Use the service’s own reset option, not a link someone sends you. Reset links and codes should arrive at the email or phone number registered on your account. If you are dealing with an account that is managed through an agent, the process can be different. This guide to resetting a locked login password explains who handles what, and the 9Wicket Hub help pages cover other common account questions.
Signs your password may already be compromised
- Login alerts from devices or places you do not recognise.
- Password reset emails you did not request.
- Friends receiving strange messages from your account.
- Your email appearing in a breach notification.
If you see any of these, change the password from a trusted device straight away and sign out of all other sessions.
Key takeaway
Use long passphrases for the few passwords you must remember, a password manager for everything else, and never reuse your email password. That combination protects you better than any complicated rule list.
