Yes, three-word passwords (passphrases) are generally considered secure and effective, balancing strong protection against brute-force attacks with being memorable, especially when words are truly random and unrelated, though some research shows common word choices reduce their strength. They work by being long and unpredictable, but adding numbers or symbols can boost security further, while using a password manager is the most robust solution for generating and storing very complex passwords.
The strength of a password often hinges upon its unpredictability and length. Three random words generate a password that is not only long enough to thwart brute force attacks but also complex enough to resist common guessing techniques.
Create strong passwords
A combination of uppercase letters, lowercase letters, numbers, and symbols. Not a word that can be found in a dictionary or the name of a person, character, product, or organization. Significantly different from your previous passwords.
Along the line of poor passwords include your kids' names, birthdays, your current street name and your pets names…all of which is information others can easily access.
"1Password is one of the best password and data management tools available. Its combination of ease-of-use, cross-device apps, and security features makes it the best choice." "One of the benefits of 1Password is that it's extremely easy to use."
Use a Combination of Letters, Numbers and Symbols
Following the "8-4 Rule" (using at least eight characters and one symbol from each of the four categories) ensures complexity, making your password harder to crack. This mix is key when you want to create secure passwords.
Passphrases of 4 to 5 words are the most optimal for securing accounts. It's even better if the phrase doesn't make sense. That way, if hackers use more sophisticated software capable of common word associations, the misdirection can help your password withstand that increased scrutiny.
Keep Your Passwords Safe Online
If you prefer convenience over security, a password manager is a secure way to store passwords online. When storing passwords offline, a paper password book is the best option. Because pen and paper cannot be hacked, they can keep your passwords safe for years to come.
The most common password patterns are just a series of numbers: 123456, 123456789, and 12345678. People are more likely to choose an easy-to-remember password over a more secure one.
Many of the stolen passwords were embarrassingly simple. Variations of “password123,” “123456,” and “linkedin” (creative, right?) were found everywhere. This breach wasn't just an inconvenience—it was a gateway for hackers to access other accounts, since many users reused the same password across multiple platforms.
What's three random words? It's simple - combine three unrelated, random words to form a long, unique password that's easy for you to remember but hard for hackers to crack. For example: CoffeeBatterySunset.
Can hackers see my saved passwords? Yes, if your device is infected with malware like a keylogger or if your passwords are stored insecurely (e.g., in a plain text file or written down). Using a reputable password manager with strong encryption can help protect your saved passwords.
The hardest passwords to crack, for a given length and character set, are random character strings; if long enough they resist brute force attacks (because there are many characters) and guessing attacks (due to high entropy). However, such passwords are typically the hardest to remember.
After hundreds of hours of testing, we found that RoboForm, at $0.99 per month for a premium plan, is the most secure, convenient, and affordable. But we also recommend NordPass, 1Password, Proton Pass, Keeper, Total Password, Aura, and Dashlane.
Shared device access risks: When multiple people use the same device or a hacker gains access to it, the stored passwords can be easily extracted. This is because web browsers often store passwords in a way that can be accessed by anyone using the device.
Storing passwords in unencrypted files, such as documents, spreadsheets, or note-keeping apps, is almost as bad as writing them down on a sticky note. If the device that contains the file is not encrypted, cybercriminals can access your passwords without much effort.
Improved security: Passkeys are phishing-resistant and enhance safety in the event of a data breach, and password managers signal to users they may be on a suspicious website by not autofilling credentials on lookalike sites.
Rule 2 – Password Complexity: Your password should contain at least one character from each of the following groups. This is often called the “8 4 Rule” (Eight Four Rule): 8 = 8 characters minimum length. 4 = 1 lower case + 1 upper case + 1 number + 1 special character.
Cybersecurity experts recommend changing your password every three months. There may even be situations where you should change your password immediately, especially if a cybercriminal has access to your account.
Methods hackers use to try and steal passwords include credential stuffing, data breach harvesting, and social engineering. Learn more about these password-stealing tactics and what you can do to help protect yourself. Then, get LifeLock to help monitor online exposure of your sensitive data, including passwords.
If you see yours here, it's time for an immediate change!
An 8-character password will take anywhere from a few minutes to a couple of hours to crack, while a 16-character password will take a hacker a billion years to crack. ❌ DON'T use passwords with fewer than 14 characters. ✅ DO use long passwords consisting of 14 characters or more.
Make It Long & Memorable
Experts have changed their way of thinking in regards to passwords. They no longer recommend using a bunch of special characters and numbers to protect against hackers. You should make your password long and memorable instead. That means using a phrase with at least 8 characters.