Passwords and password managers
Most accounts aren’t hacked through clever tricks, but because someone reused a password that had already leaked. Good passwords are therefore mainly long, unique and stored in a password manager. You then only remember one. In this article you’ll read what a strong password is, how to make it and which additional protection really helps.
What makes a password strong?
It’s about length and randomness. An attacker doesn’t try all possibilities, but first the known words, names and patterns. Welcome01! meets every rule (capital letter, digit, symbol) and is still guessed within a few seconds.
How strong a password is shows in the number of “bits” of randomness. Every bit doubles the number of attempts:
| Password | Make-up | Approximately |
|---|---|---|
| 8 random characters | letters, digits and symbols (94 possible) | 52 bits |
| 16 random characters | same | 105 bits |
| 4 random words | from a list of 7,776 words | 52 bits |
| 6 random words | same | 78 bits |
That only holds if the characters or words are truly random, not if you made them up yourself. A passphrase of four to six random words is strong and still memorable, for example for the master password of your password manager. For everything else you let a password manager generate random characters.
Make one with the Password Generator. It calculates in your browser and sends nothing away.
The four rules
- A separate password for every account. If a web shop leaks, attackers immediately try that combination on your email and bank.
- Long over complicated. Better 16 random characters than 8 characters with an exclamation mark.
- Don’t make them up, let them be generated. People choose predictably.
- Don’t change them constantly, only when something has happened (a leak, a shared account). Forcing a change every few months leads to weaker passwords.
A password manager
A password manager stores all your passwords encrypted, behind one master password. It fills them in for you and generates new ones. There are roughly three kinds:
- Online services such as Bitwarden, 1Password or Proton Pass. Syncing between your devices happens automatically.
- A file on your own device, such as KeePassXC. You take care of the backup and of copying it to other devices yourself.
- Self-hosting, for example with Vaultwarden in a container. That fits a homelab, but then you’re responsible for https, updates and backups. Don’t just open it to the internet; use a VPN instead, as in WireGuard or Tailscale.
Whichever you choose: make a backup of the vault, and keep your master password (and possibly a recovery code) on paper in a safe place. If you lose the master password, nobody can help you. More about backups: the 3-2-1 rule.
Two-step verification
With two-step verification (2FA), a stolen password is no longer enough. An order from strong to weak:
- Security key or passkey (a physical key or your phone with fingerprint): also protects against fake sites.
- Code from an app (TOTP), such as the codes your password manager or an authenticator app makes.
- SMS code: better than nothing, but can be intercepted. Only use it if there’s nothing else.
Turn on 2FA at least on your email, your password manager and everything that has money or admin rights attached.
Has my password already leaked?
Many password managers and browsers check that for you: they warn you when a saved password appears in a known data breach. If you get such a warning, change that password right away, also on every other site where you used it. How a hash works, you can see with the Hash Generator.
Is your password in the list? Change it immediately, also everywhere else you used it.
In your homelab
- Change every default password of routers, cameras, a NAS and Proxmox right after installation.
- Use SSH keys instead of passwords and turn off password login. See Cheat sheet: SSH and the SSH config generator.
- Don’t open admin pages to the internet. Reach them through a VPN.
- Give every service its own password, also for databases in Docker Compose. Don’t put them in a file you share or in a git repository.
In short
- Long, random and unique: that’s the strongest password.
- Use a password manager and make a backup of the vault.
- Turn on two-step verification, with a key or app where possible.
- Check passwords you already use for a leak.