Passwords & security

Mail, games, school, streaming: today you need an account for almost everything, and every account is protected by just one password. Whoever guesses it can write, buy and read in your name. Luckily, a few simple rules make sure exactly that does not happen.

Length beats complexity

Attackers do not guess by hand, they let computers try many passwords per second. How long that takes depends on the number of combinations: character set to the power of the length. A password of 4 digits has only 10 to the power of 4, so 10000 possibilities. Divide the possibilities by the attempts per second and you get the worst case time: at 1000 attempts per second that PIN falls after at most 10 seconds. Every extra character multiplies the possibilities, which is why a longer password helps far more than a short one with a special character. This calculation only holds, though, if the password is genuinely chosen at random: a memorable sentence, a name or a word has far fewer real possibilities and falls faster, which is why 123456 sits at the top of every list. The many attempts per second mainly apply when attackers work through the passwords from a stolen file offline. During a normal login, services delay every further attempt after a few wrong tries or lock the account for a while.

One password per service

Just as important as length: use a separate password for every service. If one service gets hacked and your password ends up online, attackers immediately try it on mail, shops and social networks. With one password per account, the damage stays limited to one service. The easiest way to do this is a password manager: a program that generates a long random password for each account and stores it safely encrypted, so you only have to remember one master password. Two-factor login makes it even safer: besides the password it needs a second proof, usually a code on your phone. More and more services also offer passkeys, where your device handles the login and there is no typed password left for anyone to intercept.

Spotting phishing

The best password is useless if you give it away yourself. In phishing, scammers send mails that look like they come from your bank or favourite shop and lure you to fake login pages. Warning signs are time pressure, odd sender addresses and links that do not lead to the service's real address. When in doubt, type the address into the browser yourself instead of clicking the link.