Secure password

how secure is my password

People type how secure is my password into a box that colors a bar green or red. That bar is a guess about how hard the string would be to enumerate from patterns: short words, dates, keyboard walks, a capital letter plus a number at the end. It is not a warrant. It does not know whether you reused the same string at a site that already leaked. It does not know whether someone will phish it. A green bar on a reused password is still a reused password.

Do not paste a live password into a site you do not trust. A checker you did not choose is an extra place that string has now been typed. If you want a strength estimate, use a tool you already trust, or the meter inside a password manager, or generate a new string and never type the old one into a random form. “How secure is my password” is a useful question. The unsafe version is handing the actual secret to a stranger’s page.

Current NIST digital-identity guidance for passwords puts the weight on length, on a check against common and leaked values, and on not adding extra composition rules. For a secret used as the only factor, that guidance sets a 15-character minimum and tells systems to allow much longer phrases. For a secret used with another factor, eight characters is the floor. Verifiers are told not to demand a mix of punctuation classes. Users answer those demands with predictable substitutions. Length and uniqueness do the work those rules pretended to do.

Length, uniqueness, and a manager

A passphrase of several ordinary words, long enough and not a famous quote, is easier to type than a short tangle you will write on a pad. A unique string per account means one leak is one leak. Reuse is how a forgotten game site opens the mail. A password manager stores those unique strings so you are not asked to memorize forty of them. Let it fill the field. Let it generate. Your job is the one master unlock and the habit of not recycling.

Make it long. Prefer a phrase or a generated string over a short costume. Make it unique. One account, one secret. Check it against known leaked values when the service or manager can do that safely. Turn on a second factor where the account offers one. A password is not phishing-resistant.

A meter that loves punctuation will praise a short password you cannot forget and an attacker can still guess.

What a checker cannot see

A local estimator cannot see a breach corpus unless it is built to query one, usually by sending a hash prefix rather than the password in the clear. Have I Been Pwned’s password list is the well-known form of that check. A page that asks for the whole password and has no such design is not that check. Scheduled rotation of a healthy unique password is the old habit NIST has been telling systems to drop. Change a password when it was reused, leaked, or shared, not because a calendar square turned red.

Hints, knowledge questions, and SMS as the only extra factor are weaker than they look. If the account offers a passkey or an authenticator app, that is the stronger door. The string in the password field still has to be long and unique. The extra factor is not permission to go back to “Name1999!”.