Passwords, Passphrases and Password Managers: A DEWA89 Guide

Reuse, Not Weakness, Is What Loses Accounts

Almost nobody is broken into by someone sitting at their login screen guessing. Attackers work from lists: an email address paired with a password, recovered from a breach somewhere else, replayed automatically against hundreds of other services. The technique is credential stuffing, and it does not need you to be interesting. It only needs you to have reused a password.

When a login database leaks, the attacker usually receives hashes rather than plain passwords - a fixed-length scramble produced by a one-way function. Hashing cannot be reversed in principle, but it can be attacked. If the site used a fast or outdated algorithm, rented graphics hardware tests billions of candidate passwords per second against the stolen hashes, with no login page to slow it down, no rate limit and no alert. Weak and reused passwords fall out of those lists in bulk; long random ones mostly do not.

Then comes the replay. Each service sees one correct-looking attempt from an ordinary residential address. That is why defences built to stop guessing often miss stuffing: there is no burst of failures to detect, just one success.

The practical consequence is uncomfortable but simple. A thirty-character password used on five sites is worth less than a fourteen-character random one used on one, because the long one is only as safe as the sloppiest site holding it. Uniqueness contains the damage. Length protects one password if its own hash leaks. You want both, but if you can only fix one thing this week, fix uniqueness.

What the Standards Actually Say Now

Most organisations copy one document for password policy: NIST SP 800-63B, Digital Identity Guidelines. Its authentication volume has retired several rules that were treated as law for twenty years, because they pushed people into predictable patterns without stopping attackers. The document binds services rather than users, but it is a useful way to recognise a website that is demanding something outdated.

Treat eight characters as a legacy floor and nothing more. Anything a manager generates for you can be long and random for free; the only place length has to be paid for in typing is the handful of secrets you memorise.

Building a Passphrase That Resists Real Cracking

Three or four secrets genuinely have to live in your head: the device unlock code, the password manager, and your primary email. For those, a passphrase of unrelated words beats a short mangled word - but only if something other than your imagination chose the words.

The standard method is a dice word list. The Electronic Frontier Foundation publishes a list of 7,776 short words, chosen with five dice rolls per word. Each word contributes about 12.9 bits of unpredictability, because 7,776 is six to the fifth power and its base-2 logarithm is roughly 12.9. Six such words give about 77 bits, which remains out of reach of offline cracking with current hardware. The strength is arithmetic, not optimism.

Why substitutions do not help

Cracking software does not begin with random strings. It begins with word lists drawn from past breaches, pushed through mangling rules: capitalise the first letter, append a year, append an exclamation mark, replace a with @, e with 3, o with 0. Those rules exist because they describe what people actually do. Tr0ub4dor&3 looks chaotic to a human and sits in the first few minutes of that queue.

Words personal to you are worse again: a pet, a street, a child's name, a support ticket number. If someone is targeting you specifically rather than stuffing a list, those are the first words they try, and social media supplies most of them for free.

• Six dice-chosen words for your password vault. Four or five where a lockout caps guessing, such as a phone or a payment card.
• Keep them lowercase and spaced or hyphenated. Do not "improve" the result into something meaningful - that restores exactly the bias the dice removed.
• Keep it on paper while you learn it, somewhere only you can reach, then destroy the paper.

The cost is real and worth stating: six words is slow to type on a phone, a TV remote or a games console. That is acceptable for three secrets and hopeless for two hundred accounts - which is what the manager is for.

What a Password Manager Does, and What Zero-Knowledge Means

A password manager is an encrypted credential database with a generator and an autofill layer. It has four jobs, and the fourth is quietly a security control rather than a convenience.

1. Generate. Long random strings, so uniqueness stops costing you anything to remember.
2. Store and sync. Encrypted, across your devices, instead of in a notes file, a spreadsheet or your head.
3. Audit. Report reused passwords, weak ones, and entries that appear in known breach data.
4. Match domains. Autofill only fires on the domain a credential was saved against. On a lookalike site it stays silent, and that silence is one of the few free warnings available to you. See recognising phishing.

Zero-knowledge, in plain terms

The claim is specific and checkable. Your vault is encrypted on your own device with a key derived from your master passphrase, and the provider stores only ciphertext it cannot read. Your passphrase is not the key itself: it is fed through a key derivation function such as PBKDF2 or Argon2, deliberately slow and memory-hungry, so each offline guess against a stolen vault costs an attacker real time and hardware.

How well a stolen vault holds up therefore rests on two things you control: the length of the master passphrase, and the iteration count configured on your account. If the provider lets you raise the iteration setting and it sits at an old default, raising it is a genuine improvement, not a placebo.

What a manager does not cover

• Your device. Malware running while the vault is unlocked can read whatever is on screen, and stealers specifically target manager data and browser cookie stores.
• Metadata. Some products leave entry titles, site addresses and your account email unencrypted. That is enough to reveal where you bank and which services you hold.
• The provider's client software, which performs the encryption and receives updates automatically. This is a trust relationship, not a mathematical guarantee.
• Both factors at once. Many managers also store TOTP codes. That is convenient and better than no second factor, but it places both factors in a single container; keep the codes for your primary email elsewhere.

Three Ways a Manager Breaks, and How to Blunt Each

Centralising credentials concentrates risk. The answer is not to avoid it - reuse is worse - but to plan for the three realistic failure modes.

The dull risk gets less attention and causes more pain: losing access through a sync conflict, a lost phone or a locked account. Export an encrypted backup to an offline drive occasionally, and keep the two credentials that unlock everything else - your email and your vault - typeable from memory rather than stored only in the vault they protect.

Checking Whether Your Details Are Already Out There

A breach notification service indexes leaked datasets and tells you whether your address appears in them. The best known is Have I Been Pwned, which names the breach, the categories of data involved and the date, and can alert you to future ones.

Checking a password is safe when it is done properly. Its Pwned Passwords feature uses k-anonymity: the password is hashed on your device, only the first five characters of that hash are sent, and the returned list of matching suffixes is compared locally. The service never receives enough to identify your password. Most password managers use the same interface for their built-in check, which covers your whole vault in one pass.

On a hit, the order matters:

1. Change the password on the service named in the breach.
2. Change that same password everywhere you reused it or used a close variant - anyone who sees your pattern tries the neighbours first.
3. Start with your primary email, because it can reset most of the rest.
4. Look for the quiet changes an intruder leaves behind: mail forwarding rules and filters, an altered recovery address or phone number, unfamiliar app passwords, sessions you do not recognise.

The limit is important: a clean result means only that no dataset this particular service holds contains your address. Many breaches are never publicly disclosed. Use a breach check as a trigger for action, never as evidence that you are safe.

Browser Managers Versus Dedicated Ones

The manager already built into your browser or phone beats reuse by a wide margin, and it is already installed. Chrome, Edge, Safari and Firefox all generate passwords, sync them, fill by domain match and run a breach check.

• Chrome: chrome://password-manager/checkup, or Settings, then Autofill and passwords.
• Edge: Settings, then Profiles, then Passwords, where Password Monitor reports leaked credentials.
• Safari, iOS and macOS: the Passwords app, or Settings, then Passwords, then Security Recommendations.
• Firefox: about:logins for saved logins and breach alerts.

Two gaps are worth knowing about. Protection at rest often defaults to your operating-system account, so anyone sitting at your unlocked computer can read saved passwords in plain view - Firefox offers a separate primary password, while Chrome and Edge can require your device password before revealing an entry. And a browser manager is tied to its ecosystem: switching browsers is awkward, there is nowhere sensible to store recovery codes or a scanned passport, and sharing a credential with a family member is not really supported.

A dedicated manager adds those things plus a vault with its own passphrase rather than your computer login. Prefer one that publishes independent security audits and a clear statement about what it can and cannot decrypt. But be honest about the comparison: a browser manager with unique passwords everywhere is safer today than a dedicated manager you keep meaning to set up.

Questions readers ask about this page

Back to top ↑