Simple or widely used passwords such as '123456' or 'password' can be cracked very quickly by automated processes. Programs that test passwords use long lists of known combinations and systematically try variants of these, making weak passwords a serious security risk.
Choose strong, easy-to-remember passwords
Basic principle: The longer the password, the harder it is to guess.
- A length of at least 8-12 characters is recommended.
- Long passwords (min. 20 characters) are significantly more resistant to password-cracking programs.
- Passwords with 25 characters or more can be sufficiently strong even with fewer types of character (e.g. no special characters).
How this works in practice:
- Think of a sentence and use the first letters of the words, interspersed with numbers or characters.
- Alternatively, you can choose passphrase-type combinations of multiple random words separated by spaces or special characters (e.g. 'Bike+Sun4Forest+Tower!').
- Avoid names, dates of birth, words that are easy to guess, and common expressions.
One password per account
Never use the same password for multiple services. Otherwise, if a password is leaked or compromised, attackers can immediately gain control of several of your accounts.
Useful password rules
- No simple sequences of numbers ('12345678') or letters
- No sequences of keyboard characters
- Adjust the length to the sensitivity of the account (e.g. email, banking, cloud services).
Use a password manager
If you require many different passwords, a password manager makes it easier to create, store and manage stronger passwords.
A password manager generates secure passwords based on current recommendations and stores them in encrypted form. You only have to remember the master password with which you protect the manager itself.
Use two-factor authentication (2FA)
A strong password alone does not protect you from all attacks. Many services additionally offer two-factor authentication (2FA).
In this case, along with the password you also have to enter a second factor like a code from an app, an SMS TAN, or a biometric confirmation. This additional obstacle can make unauthorised access much more difficult.
Only change passwords if this is necessary
In the past, changing passwords regularly was recommended. This practice is no longer standard because it can often lead to weaker passwords.
You should change passwords if:
- you become aware of a data leak
- your device is compromised
- you notice suspicious accessing
Short checklist: secure passwords
- long enough (8-12 characters, ideally ≥ 20 characters)
- not easy to guess; not personal
- unique for each account
- created/managed with password manager
- reinforced with 2FA
