In 2012, LinkedIn lost about 6.5 million password hashes to attackers, and the real damage came later. Years afterwards, a much larger dump surfaced, and security researchers noted that a huge share of the passwords inside were cracked within days. People who thought “Summer 2011!” was clever learned that hackers had already tried it. These password security tips start with a hard truth: attackers do not guess like humans; they guess like machines, and they know how humans think.
Many people now switch to passphrases, such as four random words strung together, because they are easier to remember. That is good advice, but only when done properly. This guide shows how passphrases actually get cracked, where people go wrong, and what to do about it.
What Actually Happens When a Password Is Stolen
Most attacks do not involve someone typing guesses into a login box. Websites store passwords as scrambled values called hashes, and when a company is breached, attackers steal that list. They then guess billions of possibilities offline, hash each one, and compare the results. No lockout stops them because the guessing happens on their own computers.
This is why a password that feels strong can fall quickly. The question is not whether a human could guess it, but whether a graphics card running billions of guesses per second would find it first. Weak storage by the website makes this worse, and you cannot control that part. What you can control is how guessable your secret is.
The Main Cracking Methods
Attackers rely on a few reliable techniques, often combined:
- Dictionary attacks: trying common words, names, and known leaked passwords first.
- Rule-based attacks: adding the habits people use, like capital first letters, a number at the end, and “!” as a finish.
- Brute force: trying every possible combination, which only works against short passwords.
- Credential stuffing: testing stolen email and password pairs on other websites, hoping you reused them.
- Phrase and combination attacks: joining common words together in the same way people build passphrases.
Why Passphrases Get Cracked Anyway
A passphrase is only strong when the words are truly random. The common mistake is choosing words that mean something to you, like a favorite song line, a quote, a pet name plus a year, or a famous sentence. Attackers have lists of song lyrics, film quotes, book openings, and common phrases ready to test.
Length does help, but predictability cancels it out. “I love my dog max 2020” looks long, yet it follows a pattern that cracking tools try early. Compare it with four words chosen by a dice roll or a generator, which have no connection to your life.
Common Passphrase Mistakes
- Using a famous quote, lyric, or proverb.
- Choosing words linked to your name, family, pets, or hobbies.
- Swapping letters for symbols in obvious ways, such as “a” to “@” or “o” to “0.”
- Adding the year or a simple number to the end.
- Reusing the same passphrase on several accounts.
Substitutions such as “P@ssw0rd” fool nobody. Cracking tools include those swaps as standard rules, so they add almost no protection.
Real Examples That Show the Risk
Real incidents make the lesson clearer. These are well documented cases.
- Dictionary leaks: the Rock Your breach in 2009 exposed millions of plain text passwords. The list became a standard tool, and attackers still use it as a starting point today.
- Credential stuffing at scale: in 2023, the genetic testing company 23andMe confirmed that attackers accessed accounts using reused passwords from other breaches. Users who had reused credentials were the entry point.
- Weak defaults: the Mirai botnet in 2016 took over huge numbers of internet-connected cameras and routers by trying a short list of factory default passwords.
Each case has the same cause: a predictable or reused secret. None needed advanced hacking skills.
How Strong Is Your Password? A Quick Comparison
The figures below are rough estimates for an offline attack against a fast hash. Real times depend on the hash type and hardware, but the pattern holds.
| Password type | Example style | Estimated resistance |
|---|---|---|
| Common word with a number | Football 2024 | Seconds to minutes |
| Short mixed characters | Tr7!kP2q | Hours to days |
| Famous quote or lyric | All you need is love. | Minutes, often instantly |
| Four random words | marble-tunnel-ocean-fig | Years or longer |
| Long random password from a manager | 20 plus random characters | Practically uncrackable |
How to Build a Passphrase That Holds Up
Follow these steps to build one that works.
- Use a random word generator, or roll dice against a word list, and pick at least four words. Five or six is better for important accounts.
- Do not edit the words to make them “more personal.”
- Join them with a separator such as a hyphen or space if the site allows.
- Check that it is unique and has never been used anywhere else.
- Store it in a password manager and memorize only the few you truly need, such as your manager’s master passphrase and your email.
Your email account deserves the strongest secret you own, because it can reset almost every other account. Our guide on the best cybersecurity tips for online protection explains why email is the first place to protect.
Password Managers and Two-Step Login
A password manager creates and stores a different long password for every site, so one breach cannot spread. It also warns you about reused or exposed passwords and fills them only on the correct website, which helps against fake login pages. For most people this is the single biggest improvement they can make.
Two-step login adds a second barrier. Even if a hacker has your password, they still need your phone or security key. Prefer an authenticator app or hardware key over text messages, because SIM swap attacks can redirect SMS codes.
Passkeys Are Worth Trying
Passkeys let you sign in with your fingerprint, face, or device PIN instead of typing a password. They are tied to the real website, so a fake page cannot capture them. Many large services now support them, and they remove the guessing problem entirely. Use them where available and keep a strong passphrase as a backup.
Habits That Quietly Weaken Your Security
Some mistakes are not about the password itself. Watch for these:
- Saving passwords in a notes app, spreadsheet, or browser with no device lock.
- Sharing a password by text or email.
- Typing passwords on public computers or unsecured Wi-Fi.
- Ignoring breach alerts from your manager or email provider.
- Answering security questions with real, easily found facts.
Social media is a hidden source of answers. Birthdays, pet names, and schools shared publicly give attackers material for guesses and reset questions. Our article on online safety tips to protect yourself shows how to keep that exposure low.
Passwords at Work and in Small Businesses
Small firms often share logins for tools like social accounts, accounting software, or shop dashboards. A single weak shared password can open the whole business. Use individual accounts, a team password manager, and two-step login for anything touching money or customer data.
If you run a shop, take security seriously from day one. Our guide to setting up your own online shop covers the setup basics, and the article on safety measures as everyone’s responsibility explains why staff habits matter as much as software. Good records also help, so see our tips on budgeting for beginners to spot unusual payments early.
Check Whether Your Details Have Leaked
Breaches happen to the best companies, so check your exposure. The UK National Cyber Security Centre recommends using three random words for passwords and offers free guidance on staying safe online. Visit the NCSC password guidance to see how its advice compares with what you do today.
You can also use a breach notification service such as Have I Been Pwned to see whether your email appears in known leaks. If it does, change that password everywhere it was used and enable two-step login straight away. Treat any exposed password as burned for good.
Conclusion
Attackers succeed by predicting people, not by magic. The best password security tips are simple: use truly random passphrases, keep a unique password for every account, store them in a password manager, and add two-step login or passkeys. Fix your email first, then your bank, then everything else. An hour of cleanup today can prevent months of recovery later.
Frequently Asked Questions
Are passphrases safer than passwords?
Yes, when the words are random and long. A phrase of four or more unrelated words is both stronger and easier to remember.
How long should a password be?
Aim for at least 14 characters, or four random words. Longer is better for email and banking.
Can hackers crack a passphrase?
They can if it follows a predictable pattern, such as a quote or personal words. Truly random phrases resist cracking for years.
Is it safe to use a password manager?
Yes, for most people it is far safer than reusing passwords. Protect it with a strong master passphrase and two-step login.
How often should I change my passwords?
Only change them if there is a breach or you suspect a problem. Frequent forced changes often lead to weaker choices.
