Password Safety & Security Best Practices from our Experts

Short passwords are easy for hackers to break using password-cracking software. Short passwords of six characters or less can be broken relatively easily; however, with each additional character the password becomes significantly more time-consuming, and therefore difficult, to crack. Passwords should be at least eight characters long as they are exponentially more difficult to crack than a six-character password.

Although password complexity (using upper case letters, numbers and special characters) is also desirable, according to the National Institute of Standards and Technology (NIST) it is not nearly as important as password length. A good password can be three random words or a phrase of appropriate length.

Passwords are vulnerable when they are easy to guess or when they are made public after a data breach. Password managers mitigate both risks by generating and saving complex, random passwords unique to each of a user’s accounts. Complex passwords are difficult to guess, and if one is exposed in a data breach the damage is minimized because it is not shared among the user’s other accounts.

Password managers offer free and paid options. Standalone password managers (e.g., 1Password, LastPass, Bitwarden) are typically best due to their features and flexibility, but built-in browser or operating system password managers may also meet needs. Additional password manager features include the capability to store other sensitive information (credit card numbers, addresses, etc.) as well as options to share passwords without revealing them.

After they enter a password, MFA prompts users for another way to prove their identity, such as via mobile app notification, biometric scan, or text message (SMS) code. Even the best passwords aren’t immune to being cracked or exposed to a breach; MFA is a crucial layer of additional protection.

MFA availability varies, but many banking, shopping, social media, email, and other online services provide it. MFA can also be used to protect password managers for an additional layer of defense.