Security education
Understand the threat, build the defense
A short guide to how password attacks actually work, and what makes a password resist them.
How attacks work
- Credential stuffing — attackers replay email/password pairs leaked from other breaches against new sites, hoping you reused them.
- Dictionary attacks — automated tools try common words, names and known passwords first, since most people don't pick random strings.
- Brute force — every possible combination is tried systematically; short or low-diversity passwords fall quickly to GPU-accelerated hardware.
- Pattern guessing — names, birth years, keyboard walks ("qwerty") and simple substitutions (a→@) are tried before random guessing even begins.
What actually helps
- Length over complexity — a 20-character passphrase usually resists cracking far longer than an 8-character jumble of symbols.
- Uniqueness — a password manager lets every account get its own random credential, so one breach can't cascade.
- Multi-factor authentication — even a guessed password becomes far less useful with a second verification step.
- No personal information — names, birthdays and pet names are often public or guessable from social media.
Password tips checklist