MEPX
Chapter 1 of 10All chapters
  1. 1What makes a password strong
  2. 2The reuse problem
  3. 3Password managers
  4. 4Two factor authentication
  5. 5Passkeys
  6. 6Recovery and backup access
  7. 7Breaches
  8. 8Phishing your credentials
  9. 9Where secrets live
  10. 10A realistic plan

Chapter 1 of 10

What makes a password strong

Length, not decoration.

Entropy in plain terms

Strength is how many guesses an attacker needs. Every extra character multiplies that number, while swapping a for @ adds almost nothing, because cracking tools try those rules first.

  • A long passphrase of unrelated words beats a short cryptic string.
  • Anything derived from your life is weak, however scrambled.

Why forced changes were dropped

Modern guidance from NIST and others removed routine expiry. Forcing monthly changes produced Summer2024 then Autumn2024. Change a password when there is a reason to.