How Long Would It Take to Crack Your Password?
If you have ever been told your password isn't strong enough and felt a twinge of exasperation, you are in very good company. The reassuring news is that only one thing really matters, and it isn't remembering a jumble of symbols. It's length.
How quickly could yours be guessed?
The table below shows roughly how long it would take someone with rented computing power to guess a password by trying every possible combination.
So how many characters, and which ones?
Aim for at least 15. Capitals, numbers and symbols all help, but every extra character helps far more. The easiest way to get there is a passphrase: four or five unrelated words joined together, such as harbour-kettle-42-VIOLET. That is 24 characters, you can actually type it, and no one is guessing it.
Do avoid names, birthdays, pets and football teams. Those are tried first, and they fall in seconds. And if a password of yours has turned up in a past data breach, attackers already have it on a list, so change that one today.
You are not meant to remember them all
A password manager stores every password behind one master password and fills them in for you. Bitwarden is free, well regarded and works everywhere. 1Password is the friendliest to set up and the best for families, for a few pounds a month. Proton Pass is a good privacy-focused choice. And if that sounds like a lot, the manager already built into your iPhone, Android phone or web browser is far better than nothing.
Start with the manager, then change your email password first — it is the one that can reset all the others. The rest can wait until next weekend.