Cracked in Seconds? The '3 Iron Rules' for Unbreakable Passwords and Security
Stop following outdated security advice. We expose common password myths, reveal how hackers operate, and explain the latest NIST-recommended strategies for modern password management.
Is your password "123456"?
"I'm not using such simple password." Even if you thought so, are you using passwords like below?
Password123!(Word + Number + Symbol)Taro2026(Name + Year)qazwsx(Keyboard sequence)
If these apply, your security is as defenseless as "Go out without locking the front door". Hackers use automated tools to break through these "patterns that humans tend to think of" in seconds.
This time, we explain why strong password is necessary and specifically how to manage safely.
Password GeneratorGenerate highly secure, random passwords instantly to protect your accounts.Why do passwords leak? 3 Methods of hackers
Knowing enemy is the first step of defense. Attackers aim for your password mainly by 3 methods.
1. Brute Force Attack
Method to try every combination of characters one by one. Due to improvement of computer performance, it is possible to try all combinations in few hours to few days for alphanumeric characters of about 8 characters. You can understand how meaningless short password is.
2. Dictionary Attack
Method to preferentially try words listed in dictionary such as "apple", "love", "god", and commonly used names and place names.
Tricks like "P@ssword (change a to @ etc.)" are also registered in attacker's dictionary, so effect is thin.
3. List Attack (This is most scary!)
Method to try to login to completely different site (Amazon, Rakuten, Bank etc.) using "List of ID and Password" leaked from a certain Web site. No matter how complex password you set, if you "reuse" it, it is the end. If any one place leaks, "Domino effect" occurs where all services are hijacked.
3 Iron Rules to Make "Strong Password"
Then, what kind of password is safe? Based on US security standard (NIST SP800-63B), modern correct answer is this.
Iron Rule 1: Length is Justice (12 characters or more, preferably 14 characters or more)
Strength of password is determined by "Length" rather than complexity. Every time one character increases, time required for decryption increases exponentially. At current technology level, brute force attack is almost impossible if there are 12 characters or more.
Iron Rule 2: There are no meaningless words (Passphrase)
Have you heard story that "correct-horse-battery-staple (list of words)" is stronger than "8x#K9v!m (random)"?
"Passphrase" method is easy for humans to remember and difficult for computers to decrypt.
By connecting 4 or more unrelated words, you can secure sufficient length and complexity.
Iron Rule 3: Unpredictability
You must never include information related to yourself (birthday, pet's name, phone number). It can be easily guessed by looking at SNS profile.
You only need to remember "One"
"It's impossible to remember random strings of 14 characters or more by changing for each service!" That's right. Human brain is not made like that.
That is why, let's use Password Manager. If you use tools such as Google Password Manager, iCloud Keychain, 1Password, Bitwarden, what you need to remember is only one "Master Password" to open that tool.
For passwords of individual Web sites, if you let tool "Automatically Generate", it does not matter even if it is 20 characters or 30 characters. It is the only way to maximize security level without wasting brain memory.
Another Wall: Two-Factor Authentication (2FA/MFA)
No matter how strong password is, possibility of being stolen by phishing scam (input to fake site) etc. is not zero. "Two-Factor Authentication" becomes the last fort.
- Code received by SMS
- One-time password of authentication app (Google Authenticator etc.)
- Fingerprint or Face Authentication (Biometric Authentication)
If you set this, even if password leaks by any chance, you cannot login unless your smartphone is at hand. Don't be troublesome, let's enable it for all possible services.
Frequently Asked Questions (FAQ)
Q. I am told "Please change password every 90 days"?
A. You must not change.
In latest guidelines of Ministry of Internal Affairs and Communications and NIST, periodic change is deprecated.
If you try to change frequently, humans tend to finish with simple change like "password01 → password02", and security decreases on the contrary.
You should change only "When there is suspicion of leakage".
Q. Is it okay to write password memo on paper and paste it?
A. Actually, there are cases where it is better than saving on net (because hackers cannot enter your room), but there is risk of being seen by family or colleagues. After all, password manager is optimal solution.
Summary
Security is not "cat-and-mouse game with attacker", but "creating state where cost does not match for attacker" is goal. If it is password that takes 100 years to decrypt, attacker gives up and goes looking for other target (person with weak password).
So that you do not become target. Let's graduate from vulnerable password using Jenee's tool right now.
Related Articles
