Password Creation Advice

This article provides tips for crafting a good, secure password. But let's start by alerting you to a recent major change in our password system, explained in detail in this Daily Kos post: July is Reset Your Password Month on Daily Kos: the annoying sequel The key pieces of information from that post--PLUS detailed steps for changing your password--are provided in another Knowledge Base article: Step-By-Step Password Change Instructions

Under our new system (as of summer, 2019) we have kept our requirements to a minimum, though we make some recommendations.

Our site password REQUIREMENTS:
a. Your password must be at least 8 characters long.
b. Your password must not show up on our list of "the most commonly used passwords" to be valid here.

Our site password RECOMMENDATIONS:
a. Don't REUSE passwords from site to site.
b. Make your password longer than 8 characters; aim for at least 12 characters. (No special characters are necessary.)
c. Choose a password that is easy for you to remember.
d. Consider storing your password in a password manager.

Now let's discuss some strategy behind creating a strong password.

Password writing can be intimidating. People tend to think that a random string of letters and numbers is a super-secure password that nobody could guess. For example, people assume that the password "Ab13gU7" is super secure. No one's going to guess that password, but if someone's running a decryption utility, they'll crack that password in about three hours. In contrast, if your password was "Whirled Peas" it would take someone with your basic desktop PC about two million years to crack. If a website lets you use it, the space key is your best friend in the world.

If_not,_use_underscores_instead.

That's why we need to stop thinking of passwords and start thinking of passphrases. Song lyrics or poetry snippets shot through with symbols and numbers are a great place to go. In contrast to whirled peas, the password "@11Uneedislove" would take about 32 billion years to crack. That's without spaces. When you type it as "@11 u need is love" it'd take a modern desktop about 560 sextillion years to crack it.

In short: Don't use dictionary words, and don't use a long string of letters and numbers that you can't remember. Use a phrase. Spaces are your friend, but so are symbols and numbers.

These classic Daily Kos posts offer more suggestions for ways to replace letters with symbols and numbers to help you write an easy to remember pass phrase: : How to Write Passwords and How to AVOID writing passwords