Weak credentials are still one of the easiest ways into a company's systems. If you write auth code, ship apps, or just want to stop reusing the same password everywhere, here's a practical 7-step approach to building passwords that actually hold up.
1. Go long before you go complex
Length beats complexity. Entropy scales with length, so a 20-character passphrase crushes an 8-character string of symbols. Aim for 16+ characters minimum.
# Weak (short, predictable substitutions)
P@ssw0rd!
# Strong (long passphrase)
correct-horse-battery-staple-42-quartz
2. Use a generator, not your brain
Humans are terrible entropy sources. Let the machine do it:
# 32-char random password from the CLI
openssl rand -base64 24
# Or with Python
python3 -c "import secrets; print(secrets.token_urlsafe(24))"
Use secrets, never random — the latter isn't cryptographically secure.
3. One password per account
Credential stuffing works because people reuse passwords. A breach at one service becomes a master key everywhere else. Unique credentials contain the blast radius to a single account.
4. Store them in a password manager
You can't memorize 100 unique 32-character strings, and you shouldn't try. A password manager (Bitwarden, 1Password, KeePassXC) encrypts everything behind one strong master password. For teams, this is non-negotiable.
5. Turn on 2FA — prefer hardware keys
A password is one factor. Add a second:
- Best: hardware security key (FIDO2/WebAuthn) — phishing-resistant by design
- Good: TOTP authenticator app
- Avoid: SMS codes (SIM-swappable)
If you're building auth, support WebAuthn. It kills phishing in a way OTPs can't.
6. Never hardcode or commit secrets
The strongest password is worthless in a public repo. Keep credentials out of source:
# .env — and add it to .gitignore
DB_PASSWORD=<generated-secret>
# Scan before you push
git secrets --scan
Use a vault (HashiCorp Vault, AWS Secrets Manager) for anything production.
7. Rotate on compromise, not on a calendar
Forced 90-day rotation trains users to pick weak, incremental passwords (Spring2026! → Summer2026!). Modern guidance (NIST SP 800-63B) says: rotate when there's evidence of compromise, and monitor breach databases like Have I Been Pwned instead.
Strong passwords aren't about clever symbol swaps — they're about length, uniqueness, good storage, and a second factor. Bake these defaults into your projects and your users inherit the security for free.
Originally published on strongpassfactory.com
Top comments (0)