Why random passwords beat clever ones

Most people who pick a password think they are being unpredictable. Ask a hundred of them to be unpredictable and many will do the same things. That sameness is what attackers use.

How people pick passwords

Faced with “make a strong password”, people reach for the same few moves. They take a word they like and capitalize the first letter. They put a number at the end, often a year or a birthday. They swap an “o” for a zero or an “s” for a dollar sign. They tack a “!” on the end because the site wanted a symbol.

NIST’s guidance on passwords notes this directly: users respond to composition rules in predictable ways. Someone who would have chosen a plain common word, when forced to add a capital and a number, is likely to produce that same word with a capital and a 1. The rule changed the look of the password, not how guessable it was.

What attackers do with that

Attackers do not try every combination in order. They start with the likeliest guesses, which come from three places:

• Lists of real passwords exposed in past breaches, ordered by how often each one appears.
• Dictionaries of words, names, places, sports teams and famous quotations, with the most popular lines first.
• Rules that apply the usual human edits to every entry: capitalize, add a year, swap letters for look-alike symbols, double it, put the digit at the end.

A password such as a favorite word with a swap and a date is one rule away from a dictionary entry. It takes far fewer guesses than its length suggests. A line from a favorite song or poem is worse, because you are not the only person who loves it. Quotes and lyrics are best avoided entirely, even with changes.

Strength is a property of the process

A password isn’t strong because it looks messy. It is strong because of how it was made. If a generator picks each character, or each word, using a secure random source so every option is equally likely, an attacker has no pattern to exploit. The only way in is to try possibilities until they hit it.

That is why the passphrase and password generator matters: it asks your browser’s cryptographic random number generator for every choice, the same kind of source used to make encryption keys. The strength line comes from counting the options, which you can only do honestly if chance made the choice. The companion article on how long a passphrase should be turns that count into a length.

Rules for using a random password

1. Don’t edit it. Swapping a word or adding a symbol you like puts a human choice back in. Press Make new ones and take another.
2. Use a different one for every account. One breach shouldn’t unlock your other sites. Attackers try leaked passwords everywhere.
3. Let a password manager remember them. You then memorize one long passphrase for the manager and a good unlock code for your phone.
4. Prefer length over tricks. Four or five random words beat eight characters of clever punctuation, and are easier to type. NIST advises against forcing mixtures of character types.
5. Turn on a second step where a site offers one, so a stolen password alone isn’t enough.

When a site’s rules fight you

Some sites still demand a capital, a digit and a symbol. The generator’s password mode can include each of these; the result contains every type you tick. For a passphrase, tick the options for a digit or capitals when needed. They add little strength, so treat them as a way to satisfy the form, not as protection.

Why not make it memorable instead?

It is a fair question, because you do have to remember some secrets. The answer is to make the words random and the memory work instead. Four to six random words can be pictured as a short, odd story. That is memorable and strong. A clever, meaningful phrase is memorable and weak, because meaning is what makes it guessable.