How to Create Strong Passwords to Keep Your Website Safe

“It’s important to have strong passwords because 81% of hacking-related breaches are due to weak or stolen passwords, according to the 2018 Verizon Data Breach Report,” says Darren Guccione, CEO & Co-Founder of Keeper Security. “Passwords are the single easiest entry point you can protect.”

Limited-time deals on Domains, Hosting, and Pro Services:
https://www.dreamhost.com/welcome-2022/

While a quirky word or secret nickname might seem unexpected to you, that’s not much trickier for a pro to solve.

“Criminal hackers have password cracking tools at their disposal that actually plug-in well-worn, easy to guess passwords into website logins,” says Robert Siciliano, a security analyst with Hotspot Shield. “For example, many usernames are ‘admin’ and if the password is ‘princess’ that is easy to crack with a ‘dictionary attack,’ which is a software used to crack passwords.”

If you have employees who have access to your company’s website, it’s crucial to share with them how to create a secure password. After all, even if you maximize all the steps to creating a strong password, if you’re not requiring your users to do the same, then that’s essentially creating an Achilles’ heel. Stay safe and secure by trying these 12 techniques to build a strong password.

1. Make your password long.
“Generally, a longer password takes longer to be cracked; however, it should also follow other rules to make it strong,” says Rema Deo, Managing Director at 24By7Security, Inc. “Length alone is not enough.” Aim for at least eight letters and/or characters since anything less than that takes less time to crack. The longer the password, the longer it takes to figure it out.

2. Don’t use a common phrase.
And don’t make the mistake of thinking that using an exclamation mark instead of an “I” or a “3” for the letter “E” will throw them off guard. “Algorithms used to crack passwords already consider common phrases and even common letter substitutions,” Deo cautions.

3. Test your password.
“Most websites have testing tools built-in to the setup process when creating a password,” Siciliano says. “The other option is to go to haveIbeenpwnd.com and look at their password checker tool.”

5. Use a password manager.
If you’re creating passwords the right way — meaning they’re long, with lots of numbers and characters and on the gibberish side — it’s probably pretty tough to keep track of all of them. That’s where a password manager comes in. They allow you to have multiple passwords for all of your accounts and it remembers them for you.

“Password managers generally store your passwords in an encrypted vault and therefore are meant to be more secure than other means of storing your passwords,” Deo says. “They also offer features like suggesting passwords; allowing you to enter, store and remember long complex passwords; identifying duplicate or reused passwords and allowing you to fix them.”

6. Don’t store passwords in your browser.
We know what you’re thinking: keeping passwords in your browser means they’re always at your fingertips. But like many other shortcuts in life, it just isn’t worth it. “Browsers don’t encrypt your passwords, and if a hacker gets access to your computer, the passwords stored in your browser are open game,” Guccione says.

7. Follow the rules every time.
It might seem OK to break a rule now and then, but that can be a slippery slope. Always — and we mean every single time — stick to the essentials. “Long and strong, lowercase, numbers and characters, indecipherable passwords that don’t spell anything out are best,” Siciliano says. “Otherwise, phrases incorporating the above can work. But a password manager does it best—that’s their job.”

If you want to go above and beyond (and which business owner doesn’t when it comes to their website?), take it up a notch by setting a truly unpredictable password, one that simply has nothing to do with you or any other common phrase.

8. Use two-factor authentication.
Any extra protection you can take is a good idea, and two-factor authentication means that simply having your password won’t be enough.

“A simple username and password combination has already been hacked and cracked with the 12 billion records compromised,” Siciliano says. “If you have two-factor installed, it doesn’t matter if a criminal has your username and password — they would need your mobile phone to get access.”

9. Keep an eye on your smartphone.
“Today, most people keep everything about themselves on their smartphones, from notes, contacts, lists, text messages, passwords, photos, videos, and emails—it’s all there,” Guccione says. “Hackers target smartphones because they are small and easy to steal. When a hacker is able to get physical access to your device, their chances of breaching that device increase exponentially. Each year, over 3 million phones are stolen. Keep them locked with a passcode and under a close eye!”

For more helpful tips check out our website academy at dreamhost.com/grow