Learn a few basic rules for creating secure passwords

When we talk about IT security, we have to talk about passwords too. A secure password is long, different for every account and, ideally, backed by two-step verification. Below you’ll find the basic rules, updated in line with the recommendations published in 2025.

Since people have dozens of accounts for apps, websites and services, remembering passwords can be a real headache.

Even so, passwords need to be hard to guess, so they can’t be compromised too easily. The annual rankings of the most commonly used passwords have shown the same thing for years: popular passwords can be “guessed” in less than a second.

What are the most common passwords cracked by hackers?

The passwords hackers crack most often are the most commonly used ones: strings of digits, everyday words and adjacent keys. In the ranking published by NordPass in 2019, the top ten were: 12345, 123456, 123456789, test1, Password, 12345678, zinch, g_czechout, asdf, qwerty. All of them could be cracked in less than a second, and strings like “123456” stayed at the top of the rankings in the years that followed.

Passwords made up of information about you are just as easy to guess: your child’s name and year of birth, the company name followed by the current year, or “Password123!”.

How are passwords cracked?

One of the most widely used password-cracking methods is the dictionary attack, a type of brute-force attack: a program tries popular passwords and dictionary words one after another until it hits the right one. There are also more advanced tools that add special characters to common passwords or convert words into leetspeak (1337). Example: password -> p455w0rD. That’s why replacing letters with digits doesn’t make a password more secure.

Another common hacker practice is to check whether your account has been compromised on another platform, which may have stored the password unencrypted, and to try that known password on other services (this attack is called “credential stuffing”). This is the main reason you shouldn’t use the same password for several services.

Most websites, however, store users’ passwords in an encrypted form (a hash). If the service is compromised, hackers can find out your name, email address, home address or phone number, but not your password directly. Still, short or popular passwords can be recovered from the encrypted form in a short time with powerful computers. A long, unique password stays protected even after a breach.

How long should a secure password be?

A secure password has at least 15 characters when it’s the account’s only protection. The authentication guidelines from NIST (the US standards institute), updated in 2025, require at least 15 characters for passwords used on their own and at least 8 characters when the password is combined with a second factor, such as a code from an app on your phone.

The same guidelines changed a few old rules:

• length matters more than complexity: rules that force you to include an uppercase letter, a digit and a symbol are no longer recommended;
• passwords are no longer changed periodically, only when there are signs they’ve been compromised;
• new passwords are checked against a list of compromised or very common passwords, and any found there are rejected;
• pasting passwords (copy-paste) and password managers must be allowed.

Examples of secure passwords

The easiest secure password to remember is a phrase made of four or five unrelated words. Here are a few examples of the structure; don’t use them as they are, because they’re now public:

• a string of words: kitten-tram-tea-mauve-Galati;
• an absurd sentence: Grandma plants 3 cacti on the Moon;
• a password generated by a password manager: k7#Vq2!mR9pL$wX4zT, which you don’t need to remember.

Recommendations for choosing secure passwords

• Use a password manager. It generates long, random passwords that are different for each account and remembers them for you. You only need to remember the master password, which must be long and unique.
• Turn on two-step verification wherever you can. Logging in then also requires a second device: an authenticator app on your phone, a security key or a code received by text message. A text message code is better than nothing, but the app and the security key are more secure.
• Use passkeys where they’re available. Google, Microsoft and Apple accounts, as well as more and more websites, let you log in with your fingerprint, facial recognition or your device PIN, without a password. A passkey can’t be guessed and doesn’t work on a fake site, so it also protects you from phishing.
• Don’t reuse passwords. Every account gets its own password, especially your email, because email is used to reset the passwords of all your other accounts.
• Delete accounts you no longer use. That way, you reduce the number of places your data can be stolen from.
• Check the activity on your accounts regularly. If you notice unusual logins, change the password right away and log out of the active sessions. You can also check whether your email address has appeared in a known breach on Have I Been Pwned.

How does a company manage its employees’ passwords?

A company manages its employees’ passwords through written rules, not through each person’s memory: a team password manager, with shared vaults for accounts used by several colleagues, mandatory two-step verification on email and administrator accounts, and a clear record of who has access to each system. Passwords aren’t sent by email or in messages, and they aren’t written on sticky notes on the monitor.

Most problems happen when an employee leaves: their accounts stay active, and the shared passwords they knew aren’t changed. For our clients, we set up computers and accounts for new employees and close the access of those who leave. When we take over IT from another provider, we draw up a written plan within 24 hours, covering the handover of access and documentation and the changing of passwords.

For companies covered by the NIS2 Directive (in Romania, GEO 155/2024), two-step verification and access control policies are among the measures required by law.

RezolvIT is a managed IT services company in Bucharest that provides personalized IT support to the companies it works with, whether it’s IT security, securing laptops used at home or employees working remotely. We start with a free IT audit.