I’d say the ideal password is simple—while still strong, too. And what fits that definition can change depending on the context. Hear me out.
Welcome to Safe Mode, your weekly report for pressing security and privacy news—and what steps to take next. Want this newsletter to come directly to your inbox? Sign up on our website!
In some cases, the ideal password is actually a passkey. (So not a password at all.) They’re the epitome of simple and secure. No memorization and not reusable, with baked-in elements of two-factor authentication. For these reasons, I recommend their use first to most people.
Meanwhile for websites that lack passkey support, an ideal password is indeed something long, random, and unique—something easily generated and stored by a password manager. You’ll spend as little effort on a 32-character password as you would an 8-character version.
But what about when you actually have to memorize a password? My opinion has shifted most on the approach here. You should memorize at least a handful—at minimum two passwords, one for your password manager and the other for your email address. You don’t want to find yourself locked out of your email address or another important account (e.g., banking) because you lost access to your password manager.
Doing so shouldn’t feel hard, though. I used to equally suggest passphrases and pseudo-randomization (e.g., pulling the 2nd letter from song lyrics you know and interspersing numbers and special characters). Now I’m much more in the passphrase camp. The longer, the better. If you’re capable of memorizing a random mix of words, bonus points.
What changed my mind: Looking once again at password cracking charts.