Password selection requirements have become stricter in recent years. Many services now require users to use special characters and some organizations have increased the minimum password length to 16 characters or more. In some technology companies employees are even asked to change their passwords periodically and to use a different password each time.
Although using password generator tools can help create complex combinations that are hard to guess, one major problem remains: remembering these passwords. If a user cannot recall their password, excessive complexity can become a practical problem. So the question arises: what is the appropriate length for important passwords?
What is the appropriate password length?
The ideal password length has been identified as between 14 and 16 characters. This suggestion is consistent with a theory from Nelson Cowan, a psychologist. He believes human working memory capacity is limited to roughly four “chunks” at a time.
Accordingly, if a 14- to 16-character password is composed of three to five recognizable and memorable chunks, it will be easier to remember.
On the other hand, according to information provided by the password management service Bitwarden, a 16-character password made from a combination of different character types can be highly resistant to brute-force attacks and cracking it by that method could take centuries.
Nonetheless, many services still set an 8-character minimum when creating an account. With increasing cyber threats, using longer passwords can raise the security level of user accounts.
How do we create a password that is both secure and easy to remember?
Longer passwords generally offer more security, but they are also harder to remember. One suitable solution to this problem is using a passphrase instead of a word or short combination.
A passphrase can be a short, memorable sentence or a set of several seemingly unrelated words separated by spaces, hyphens, or other punctuation. You can treat this phrase as a mnemonic that the user associates with the login process for their account, making it easier to remember.
Multi-word passphrases can also be more resistant to dictionary attacks. In a dictionary attack, an attacker uses programs that automatically try a set of common words, frequent combinations, and their likely variations to gain access to an account.
If a passphrase consists of several words that are not usually used together, the likelihood of success for such attacks decreases.
What to do when you have many passwords?
But if you have 12 different accounts with 12 different passwords, all more than 16 characters, remembering them all can be difficult. In such cases, using a password manager can be an appropriate solution.
Password managers allow users to create and store complex, distinct passwords for different accounts without having to remember them all. However, like any security tool, using these programs also requires attention to security best practices.
One common method of stealing passwords is directly observing the password as it is entered or having physical access to the user’s phone and computer. An attacker might be able to find a password manager app on the device, but if master passwords and sensitive information are properly protected, accessing them will still require getting past the relevant security layers.
Ultimately, using long, unique, and memorable passwords, along with a reputable password manager and other security measures, can help better protect user accounts.