Level 1 · 1A Passwords · Lesson 2 of 3
Make a steel-strong password, and what to do if you get hacked
The recipe that works best: a phrase of 4 to 6 random, unrelated words separated by hyphens. For example "moon-bike-cloud-thunder-ladder". Avoid famous sayings and song lyrics: they're on attackers' lists too.
You don't need to remember all your passwords. A password manager (there are free and paid ones, or the one built into your phone) creates a long, different password for each account and stores it encrypted. You only remember one: the master password, which is your long phrase.
If you got hacked, the order matters
First cut off the attacker's way in: change your password from a device you trust and sign out of the sessions open on other devices. Then strengthen the account by turning on two-step verification. Finally, stop it from spreading: change the password on other accounts where you used the same one, and tell your contacts not to open strange links coming from you.
Going deeper
Why random words work
If you pick each word at random from a list of 7,776 words (a method called Diceware), each word adds about 12.9 bits of randomness. With 5 words that's about 64 bits: more than 18 quintillion combinations. What matters is that the choice is truly random, not that it seems strange to you.
Review questions
What's a good starting point for a password you can remember?
Answer: 4 to 6 random words separated by hyphens. It's long, doesn't depend on details about you, and you can remember it with a mental picture. A single word, even with symbols, is short.
You notice someone got into your account. What do you do first?
Answer: Change your password from a device you trust and sign out of the other sessions. The first thing is to cut off the attacker's way in. Then you strengthen the account and stop it from spreading.
What's the advantage of a password manager?
Answer: It creates long, different passwords, and you only remember one. It solves the problem of having to remember lots of long passwords. It doesn't replace the second step: you use them together.