Attackers can use multiple methods, most often automated, to crack your password. These methods can consist of brute force attempts, dictionary attacks and social engineering (e.g. via phishing). A strong password can help deter the first two attack methods so you should keep the following in mind when selecting a password:
Make passwords at least eight characters long (twelve or more is preferred)
Don't use a username, a real name, or a company name
Don't use a single dictionary word (even slang and foreign languages); a multi-word phrase is much better
Don't use phone numbers, Social Security numbers, license plates, or birthdates
It should be significantly different from previous passwords
It should contain characters from each of the following groups:
Uppercase and lowercase letters
Numbers
Symbols (!, @, #, $, %, etc.)
Don't use the same password for multiple accounts (e.g. Swarthmore, Amazon, Gmail, etc.)
With today's password cracking capabilities, using any single word as part of a password, even with numbers substituted for letters, is NOT sufficient.
You should never share your passwords including with supervisors or co-workers. Don't write it down and then leave it on your display, under your keyboard, etc. In your browser (e.g. Chrome, Firefox, Safari, Internet Explorer, Edge, etc.), you should always disable the Save Password option.
You can change your password any time.
Below are some ideas for generating strong yet memorable passwords (from: 'Perfect Passwords: Selection, Protection, Authentication' by Mark Burnett):
Use three words (or more) together but not as a phrase.
Could be 3 synonyms, homonyms, antonyms, rhymes, etc.
Examples: WonSunTon, Pleasekeysfleas, Basesbasisbasses
Use a made-up email address (not your own!).
Pick a name then a related phrase for the address.
Examples: Mickey@mouseworld.net, vacation@aruba.com
Model your password after a real or made-up URL.
Examples: www.whatsmypassword.com, www.nonewsisgood.org, ftp.drydesert.edu
Use word and number combinations that rhyme.
Pick two or more numbers and then a phrase that rhymes.
Hint: get some ideas from www.rhymezone.com
Examples: 43FruitTree!, 488studentsintheDebate?
Use a common phrase stated in an uncommon way or as a question.
Examples: Temperaturesensitivedevice (e.g. a thermometer), whatISamovieonadisk? (e.g. DVD)
Think of a personal secret (perhaps embarrassing?) that only you know.
Examples: asleep@Meeting!
Invent an imaginary phone number.
Consider including spaces, dashes, and parenthesis.
Hint: don't use 867-5309 from the 1980s song...
Examples: (800) Sec-urme, 1-888-keepout
Take two or more words and swap the first letters.
Capitalize one or both of the first letters
Examples: Eink plephant, hexas Told-em!
Use a password generator
Password generators such as the Keeper Password Generator can generate secure passwords with the click of a button.
Use a password manager
There are a number of reputable on-line and off-line password managers available. Some are free and others charge for their services.
If you are an employee of Swarthmore College, you can use the online password manager Keeper for free. To get started, follow our posted instructions.
Family members of Swarthmore employees can set up Keeper accounts too! Take a look at our instructions.
A good password choice is one that is very hard to guess but also easy to remember.
Finally, below are the ten most common (and horribly weak) passwords discovered from website hacks (courtesy of the Wall Street Journal):
123456
password
12345678
lifehack
qwerty
abc123
1111111
monkey
consumer
12345