{"id":5215,"date":"2024-12-03T06:00:06","date_gmt":"2024-12-03T14:00:06","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=5215"},"modified":"2025-01-24T01:20:42","modified_gmt":"2025-01-24T09:20:42","slug":"4-tips-for-creating-secure-passwords","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/4-tips-for-creating-secure-passwords\/","title":{"rendered":"4 Tips for Creating Secure Passwords"},"content":{"rendered":"

\"\"<\/a><\/p>\n

In a previous article, I outlined four types of passwords you shouldn\u2019t create unless you want your account hacked<\/a>. Given how valuable your passwords are, it\u2019s important that they be secure, yet not too hard to remember. Not only do passwords protect your e-mail account, your social media accounts, and any web services you use, but also many accounts linked to your credit card, such as your Amazon, eBay, and PayPal accounts.<\/p>\n

Here are four tips showing how you can create secure passwords:<\/p>\n

Tip #1: Size Matters<\/h3>\n

With passwords, bigger is better. With the power of todays computers, a 6-character password can be cracked easily using \u201cbrute force\u201d techniques (where a computer simply tries every possible combination of characters) in mere seconds. An 8-character password may take hours if it’s complex enough; 10 characters would take even longer. If you want to be really secure, go for 12 characters or longer. But also make sure that your passwords aren\u2019t of the type that are commonly used, such as those listed on this Wikipedia page<\/a>.<\/p>\n

Tip #2: Variety is the Spice of Life<\/h3>\n

There are four types of characters you can use in passwords:<\/p>\n

    \n
  1. lower-case letters (a, b, c, etc.)<\/li>\n
  2. upper-case letters (A, B, C, etc.)<\/li>\n
  3. digits (1, 2, 3, etc.)<\/li>\n
  4. \u201cspecial characters,\u201d which include punctuation (. ; ! etc.) and other characters (# * & etc.)<\/li>\n<\/ol>\n

    There are 26 lowercase letters, 26 uppercase letters, 10 digits and, depending on the web site, as many as a couple dozen special characters (most sites won\u2019t let you use certain characters).<\/p>\n

    If you create a password with 8 random digits (that is, numerals only), there are 108<\/sup> (100 million) possibilities \u2014 everything from 00000000 through 99999999. If you use, however, 8 random lower-case letters, the number jumps to 268<\/sup> (over 208 billion, with a b). With a combination of numbers, upper- and lower-case letters, and special characters, the number of possibilities for an 8-character, pseudorandomly generated password can be in the trillions.<\/p>\n

    Combine this with tip #1, using a longer password, and see these numbers expand faster than the universe during the Big Bang. Of course, these numbers assume truly pseudorandomly generated passwords. For example, if you were to choose an 10-character password like Password1!<\/code>, it wouldn’t take long to brute-force crack the password. But a 10-character password like y8E&@.o3Tc<\/code> \u2014 which is just as long and also uses upper, lower, numbers, and special characters \u2014 would be significantly more difficult to crack, because it doesn’t incorporate words or predictable patterns.<\/p>\n

    Tip #3: Create Unique Passwords<\/h3>\n

    The best way to create unique passwords is to generate pseudorandom ones and store them in your password manager\u2014but we’re getting ahead of ourselves; that’s tip #4.<\/p>\n

    Let’s assume that you need to come up with a password that you’re going to need to type often, so it needs to be memorable, but you also want it to be relatively strong. Here\u2019s an easy way to create unique, memorable passwords that are difficult to crack. You can use a password like this for the user account on your iPhone or your Mac, which is very important: if anyone can get into your phone or computer, they can access your e-mail, your files, and all your personal information.<\/p>\n

    To start with, try to come up with a short phrase or sentence that will be memorable to you, but preferably isn’t an axiom or anything in any public record like a book. As an example, let\u2019s say you\u2019re a big fan of the Game of Thrones<\/em> TV series, and you think it’s the greatest of all time (“the GOAT,” as the kids say). You shouldn’t use gameofthrones<\/code> or a variation thereof as your password, which could quite plausibly be in password cracking dictionaries (databases of known or likely passwords). But your first thought might be to create a password similar to this \u2014 please don’t use any of these examples<\/strong><\/em>:<\/p>\n

    gotisthegoat<\/code><\/p><\/blockquote>\n

    That\u2019s 12 characters, so it\u2019s fairly long, but it\u2019s all lower-case letters. Let\u2019s throw in a couple of upper-case letters to make it more complex, but not in predictable locations (such as the first letter of the password or a word within it):<\/p>\n

    gOtistHegoAt<\/code><\/p><\/blockquote>\n

    That\u2019s a bit better. But now, let\u2019s spice it up with a couple of digits. These have to still be easy to remember, right? How about this:<\/p>\n

    g0tistH3goAt<\/code><\/p><\/blockquote>\n

    And the addition of even one special character theoretically makes this much harder to crack:<\/p>\n

    g0tistH3g@At<\/code><\/p><\/blockquote>\n

    If something like that is too difficult to remember, you can simplify it a bit. To make it a bit more memorable, let\u2019s just use one capital letter, one digit, and one special character, and add a 13th character on the end for good measure:<\/p>\n

    g0tistHeg@atz<\/code><\/p><\/blockquote>\n

    Again, don’t use these specific password examples.<\/strong> But if you’ve gone through this exercise on your own, you now have a password that is relatively secure while also being memorable. According to the site How Secure Is My Password<\/a>, the last example above would supposedly take about 1 hundred quintillion years for a single computer to crack\u2014but computer technology is getting faster, AI is being used to crack passwords<\/a>, and quantum computing is on the horizon<\/a>. Even setting aside future advancements, relatively inexpensive technologies are easily available to attackers today, such as cloud computing clusters. GRC’s Password Haystacks page<\/a> estimates that it would take a “massive cracking array” up to 1.65 hundred centuries to crack this password based on today’s tech.<\/p>\n

    A password like the last example above is also complex enough that an average person watching you type it (an attack called “shoulder surfing”) may have a hard time comprehending what you’re typing, let alone memorize it. So a password like this should be good enough for logging into your computer or your phone.<\/p>\n

    One downside is that this password is difficult to type, but the next tip explains how to get around that.<\/p>\n

    Tip #4: Use Your Keychain to Store Passwords, or Use a Password Manager<\/h3>\n

    Even if you have one really secure password memorized, you shouldn\u2019t reuse it for all your web sites and services. This is because of credential stuffing attacks<\/a>; if one site’s database gets breached, hackers may try to reuse publicly exposed username and password combinations to log into other sites. Since remembering several dozen complex passwords is implausible, you’ll need a secure way to store all those unique passwords. That’s where a password manager comes in.<\/p>\n

    If you primarily use Apple devices, you can use the Passwords app in macOS and iOS<\/a> to store passwords. The Passwords app (which leverages Apple’s Keychain technology) is what \u201cremembers\u201d passwords when you enter them in Safari, along with the passwords you use for Mail and other programs. You can also use one of many password managers available<\/a> (choose one that’s reputable and well-known\u2014but not LastPass<\/a>). Just make sure that the master password you use for this software is as strong as the example above.<\/p>\n

    Some password managers give you the option to choose “easy to type” passwords, which is a nice bonus. So, for example, you could generate something like Egad-FIERY6-jesters<\/code> \u2014 which is both longer and easier to type on an iPhone or other digital keyboard than the g0tistHeg@atz<\/code> example from earlier, and it’s not terribly difficult to memorize if you need to.<\/a><\/p>\n

    How can I learn more?<\/h3>\n

    \"\"<\/a>Each week on the Intego Mac Podcast<\/strong><\/a>, Intego’s Mac security experts discuss the latest Apple news, including security and privacy stories, and offer practical advice on getting the most out of your Apple devices. Be sure to follow the podcast<\/strong><\/a> to make sure you don\u2019t miss any episodes.<\/p>\n

    You can also subscribe to our e-mail newsletter<\/strong><\/a> and keep an eye here on The Mac Security Blog<\/strong><\/a> for the latest Apple security and privacy news. And don’t forget to follow Intego on your favorite social media channels: \"Follow<\/a>\u00a0\"Follow<\/a>\u00a0\"Follow<\/a>\u00a0\"Follow<\/a>\u00a0\"Follow<\/a>\u00a0\"Follow<\/a>\u00a0\"Follow<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    The passwords you use regularly need to be strong, but also memorable. Learn these four simple ways to ensure that your passwords are secure. <\/p>\n","protected":false},"author":46,"featured_media":35575,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[10],"tags":[353,96,106],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n