The most common passwords in data breaches year after year are "123456", "password", "qwerty", and name+birth year combinations. Not because people are careless — but because memorising dozens of unique, complex passwords is genuinely impossible without a system.
The result is password reuse: most people use the same handful of passwords everywhere. When one site is breached (and sites are breached constantly), attackers run those credentials against every major service — banking, email, shopping — in automated attacks called credential stuffing.
This guide covers what actually makes a password strong, how attackers crack them, and practical strategies that work in the real world.
Attackers don't try random characters — they start with known words, common phrases, and previous breach data. "password", "letmein", "iloveyou" are cracked in milliseconds. Adding a number and symbol at the end ("Password1!") only adds a few seconds to the attack — these patterns are well-known.
Every possible combination is tried systematically. Modern GPUs can test billions of hashes per second against stolen password databases. Short passwords fall quickly regardless of complexity:
| Password Length | Character Set | Approximate Crack Time* |
|---|---|---|
| 8 characters | Lowercase only | Minutes |
| 8 characters | Mixed case + numbers + symbols | Hours to days |
| 12 characters | Mixed case + numbers + symbols | Centuries |
| 16 characters | Mixed case + numbers + symbols | Practically infinite |
*Against a fast offline hash attack. Online attacks (login forms) are limited by rate throttling; offline attacks occur when databases are stolen.
Leaked username/password pairs from one breach are automatically tested against other services. If you reuse passwords, a breach on a small shopping site can give attackers access to your bank account. This is currently the most common attack vector.
Two things matter most, in order of importance:
Special character substitutions (replacing 'a' with '@', 'o' with '0') add almost no security — these are among the first transformations attackers apply to dictionary words.
This is the gold standard. A password manager generates and stores a unique 20+ character random password for every account. You memorise one master password; the manager handles everything else.
Recommended managers: Bitwarden (open source, free), 1Password, Dashlane. Browser-native options (Apple Keychain, Chrome's password manager) work well if you're already in that ecosystem.
A manager-generated password looks like: Kx9#mQ2@pLvN7^tR — impossible to remember, no need to try.
Diceware generates a passphrase by randomly selecting words from a large wordlist using physical dice (or a secure random generator). The result is memorable but highly secure:
correct-horse-battery-staple — 4 random words from a 7,776-word list gives 2⁵¹ possible combinations. More secure than most 10-character complex passwords, and memorisable.
Use diceware for: your password manager master password, device unlock passwords, and any password you genuinely must remember without a manager.
At minimum 12 characters for any account that matters; 16+ for important accounts like email, banking, and your password manager master password. Length is the most important factor — each additional character exponentially increases the search space. A 16-character password with mixed case, numbers, and symbols is effectively uncrackable by brute force with current technology.
For passwords you need to memorise, yes. A random 4-word diceware passphrase (like "correct-horse-battery-staple") has around 51 bits of entropy and is vastly more memorable than a short complex password. For passwords stored in a manager, fully random is better — use a 20+ character string you'll never need to type manually.
The old 90-day rotation advice is outdated. NIST (US National Institute of Standards and Technology) explicitly recommends against mandatory routine password rotation in their latest guidelines — it leads to predictable patterns like Password1!, Password2!. Change a password immediately when there's a known breach or suspected compromise, but otherwise keep a strong unique password indefinitely.
Start using a password manager. This single change lets you have a unique, random, long password for every account without memorising any of them. It eliminates credential stuffing attacks entirely — your leaked LinkedIn password cannot be used on your bank. Free options like Bitwarden make this accessible to everyone.