Password Security: How to Create Strong Passwords and Protect Your Accounts

Password Security: How to Create Strong Passwords and Protect Your Accounts

Student Vocation Cybersecurity Learning Series — Lesson 7 of 30

Imagine that you use the same password for your email, school portal, social media, and several other websites.

One day, a website you use experiences a data breach, and your password is exposed.

A cybercriminal may try that same password on your other accounts. If it works, one compromised account could lead to several more.

This is one reason password security is essential.

Your password is often the first line of defence protecting your personal information, schoolwork, private conversations, and digital identity.

In this lesson, you will learn what makes a password strong, why reusing passwords is risky, how password managers work, and what to do if you suspect your password has been exposed.

1. What Is Password Security?

Password security refers to the practices and technologies used to protect passwords and prevent unauthorized access to accounts.

A secure password should be difficult for someone else to guess, should not be reused across unrelated accounts, and should be stored and handled safely.

Passwords help protect accounts such as:

• Email accounts.
• School and university portals.
• Social media profiles.
• Online banking services.
• Shopping websites.
• Cloud storage.
• Work applications.
• Website administration dashboards.

For students, protecting an email account is particularly important because it may be used to reset passwords for many other services.

Key idea: A password should be treated like a private key to your digital identity. Do not share it casually or store it where other people can easily access it.

2. What Makes a Password Strong?

A strong password is difficult to guess or discover through automated password-guessing attempts.

Several factors contribute to password strength.

1. Length

Longer passwords generally provide more possible combinations, especially when they are unpredictable.

A short password such as cat123 has very little protection against common guessing techniques.

A longer password made from several unrelated words can be easier to remember while providing many more possible combinations.

For important accounts, choose a long password. A practical target is at least 15 characters when the account relies on a password alone, unless the service has different requirements.

1. Unpredictability

Avoid passwords based on information that other people may know or discover, including:

• Your name.
• Your birthday.
• Your phone number.
• Your school or company name.
• Your favourite football club.
• Common keyboard patterns.
• Common words followed by simple numbers.

Adding a number or symbol to a predictable password does not necessarily make it secure.

For example, changing Password to Password123! follows a familiar pattern that password-guessing systems may already anticipate.

1. Uniqueness

Every important account should have its own password.

Do not use the same password for your email, social media, school portal, and banking account.

If one service is breached, a unique password helps prevent the exposed password from unlocking your other accounts.

1. Avoiding common or compromised passwords

Passwords such as 123456, password, and predictable variations are widely known and should never be used.

Some services check new passwords against lists of common or previously exposed passwords. When available, these checks help prevent users from choosing passwords that attackers are likely to try.

3. Password Examples: Weak, Predictable, and Better Designed

The following are fictional teaching examples only. Never adopt these example strings as passwords for real accounts.

A longer passphrase can be a useful choice when a service permits it. However, the words should not form an obvious quotation or a phrase associated with your personal life.

Randomly generated passwords are often a good choice for accounts where memorization is unnecessary because a password manager stores them securely.

Remember: length, unpredictability, and uniqueness work together. No single symbol or number automatically makes a password strong.

4. What Is a Passphrase?

A passphrase is a password made up of multiple words or a longer sequence of characters.

For example, a fictional teaching passphrase might combine unrelated words such as:

Harbor-Cactus-Moonlight-Teacup

This example is for learning only and should not be used for an actual account.

A randomly generated passphrase can be easier to remember than a random string of characters while still offering substantial resistance to guessing.

When creating a passphrase:

1. Use enough length to meet the service’s requirements.
2. Avoid famous quotations and predictable expressions.
3. Do not use information connected to your personal life.
4. Keep the passphrase unique to the account.
5. Store it securely if you cannot reliably remember it.

A passphrase should not be confused with a recovery phrase or a multi-factor authentication recovery code. Those are different types of sensitive information and need their own protection.

5. Why Is Password Reuse Dangerous?

Password reuse occurs when someone uses the same password for multiple accounts.

Suppose a student uses one password for a discussion forum and their main email account.

The discussion forum later experiences a breach. If the student used the same password for email, an attacker may attempt to sign in to the email account using the exposed credentials.

This is known as credential stuffing: attackers try previously exposed username-and-password combinations on other services.

How unique passwords help

Consider two situations.

Situation A: The same password is used everywhere. An exposed password could put several accounts at risk.

Situation B: Each account has a different password. A password exposed by one service cannot automatically unlock the other accounts.

Unique passwords do not eliminate every risk, but they significantly limit the damage caused by password exposure.

6. Common Password Attacks Explained

Understanding common attacks helps explain why good password habits matter.

1. Brute-force attacks

A brute-force attack attempts many possible password combinations until a match is found.

Long, unpredictable passwords make this approach more difficult.

1. Dictionary attacks

A dictionary attack tries passwords drawn from lists of common words, phrases, and predictable variations.

Avoiding common passwords helps reduce this risk.

1. Credential stuffing

Credential stuffing uses username-and-password combinations exposed in previous breaches and tests them against other services.

The most effective everyday defence is to use a different password for every account.

1. Phishing

As explained in Lesson 6, phishing tricks people into revealing information on fraudulent websites or through deceptive messages.

Even a very strong password can be stolen if you enter it into a fake login page.

Before signing in, verify that you are using the legitimate website or application.

1. Shoulder surfing

Shoulder surfing occurs when someone observes a person entering a password.

Be aware of people nearby when entering sensitive credentials, particularly in public places.

1. Malware and keylogging

Some forms of malware can record keystrokes or steal information from an infected device.

Keeping your operating system and security software updated, avoiding suspicious downloads, and using trusted applications can reduce exposure to these threats.

These attacks use different methods, so password length alone cannot defend against all of them.

7. What Is a Password Manager?

A password manager is a tool that stores and organizes passwords in an encrypted vault.

Depending on the product, it may also generate strong passwords, fill login forms, and warn users about certain security problems.

Instead of memorizing a different password for every service, you remember a strong master password or use the manager’s supported authentication method to unlock the vault.

Benefits of a password manager

• It can generate long, random passwords.
• It helps you maintain unique passwords for different accounts.
• It reduces the temptation to reuse easy-to-remember passwords.
• It can help identify duplicate or weak passwords.
• It may make secure sign-in more convenient.

How to choose one

Choose a reputable password manager that uses strong encryption, supports secure account recovery, and provides clear information about its security practices.

Keep the password manager’s master password private and strong.

Enable multi-factor authentication for the password manager when available.

Download applications from official sources and be cautious of fake password-manager extensions.

Is saving passwords in a browser safe?

A browser’s built-in password manager may provide useful protection when it is configured correctly and your device account is secured.

However, the level of protection and available features vary between browsers.

Use a strong device password, keep your browser updated, and avoid leaving a shared or public computer signed in to your personal accounts.

8. Where Should You Store Your Passwords?

Avoid storing passwords in easily accessible places, such as:

• Unprotected notes on a shared computer.
• Public documents.
• Messages sent to friends.
• Unsecured spreadsheets.
• Papers left where other people can see them.
• Shared cloud documents without appropriate access controls.

A reputable password manager is usually a better option for storing many unique passwords.

If you must keep a written record for a specific reason, store it in a secure, private place where unauthorized people cannot access it.

Never send passwords or recovery codes through an ordinary message simply because it seems convenient.

9. How Often Should You Change Your Password?

You do not necessarily need to change every strong password on a fixed schedule if there is no indication of compromise and the service does not require a change.

Instead, change a password promptly when:

• You believe someone else knows it.
• A service reports that your password may have been exposed.
• You entered it into a fraudulent website.
• You accidentally shared it.
• You discover that you reused it on an account affected by a breach.

When changing a password, choose a new, unique one rather than making a small predictable modification to the old password.

Follow the service’s security instructions if it detects suspicious activity or requires a reset.

10. How to Protect Your Passwords in Everyday Life

Follow these practical habits.

Use a unique password for every important account. Start with your main email, school account, financial accounts, and password manager.

Use long, unpredictable passwords. A trusted password manager can generate them for you.

Never share your password. Be cautious even when a message claims to come from technical support or an administrator.

Avoid entering passwords through unexpected links. Visit the official website or application independently.

Secure your devices. Use a device password or other supported screen-lock method and keep software updated.

Enable multi-factor authentication. This adds another layer of protection beyond the password. We will explore it in Lesson 8.

Review account activity. Look for unfamiliar sign-ins, changed recovery details, or unexpected security notifications.

Log out of shared devices. Do not save passwords on public or shared computers unless you understand and control the security implications.

Protect recovery options. Keep recovery codes and account-reset methods secure and accessible only to you.

Be careful with password-reset requests. If you receive an unexpected reset notification, do not approve it automatically. Check the account through its official service.

11. What Should You Do If Your Password Is Exposed?

If you suspect that a password has been stolen or disclosed, act promptly.

1. Use a trusted device. If you suspect your device is compromised, use a different trusted device where possible.
2. Open the genuine service. Navigate to the official website or application rather than using a suspicious message link.
3. Change the exposed password. Choose a strong, unique replacement.
4. Change reused passwords. If the exposed password was used on other accounts, replace it on those accounts too.
5. Review active sessions. Sign out unfamiliar sessions or use the service’s option to sign out of all devices.
6. Check recovery information. Look for unexpected changes to recovery email addresses, phone numbers, or other security settings.
7. Enable multi-factor authentication. Use an appropriate supported method to add another layer of protection.
8. Contact official support if needed. If you cannot access the account or notice unauthorized activity, follow the provider’s recovery process.

If the affected account is used for school or work, notify the appropriate administrator or security team.

12. Safe Practical Activity: Password Security Checkup

Activity title: Build a Personal Password-Security Plan

Objective: Learn to identify password weaknesses and create a plan for protecting accounts without disclosing any real credentials.

Safety rules:

• Do not write down or submit your real passwords.
• Do not paste passwords into online strength-checking websites.
• Do not use the fictional examples below for actual accounts.
• Do not share recovery codes or password-manager master passwords.

Part A: Evaluate fictional passwords

Assess the following teaching examples.

Example 1: 12345678

Question: What makes this password weak?

Example 2: Student2026!

Question: Why is adding a number and symbol not enough to make this password strong?

Example 3: River-Candle-Planet-Maple

Question: What makes this example longer, and why should you still avoid using it as your real password?

Example 4: A randomly generated, unique password stored in a reputable password manager.

Question: Why is this approach generally preferable for an important online account?

Part B: Review a fictional account list

Imagine that a student has the following accounts:

Identify at least three problems and propose a safer practice for each one.

Part C: Create your improvement plan

Without writing any actual passwords, complete these actions:

1. Identify your three most important online accounts.
2. Check whether each account uses a unique password without revealing the password itself.
3. Identify accounts that need stronger passwords.
4. Decide whether a reputable password manager would help.
5. Plan to enable multi-factor authentication where available.
6. Review account-recovery options and make sure they are secure.

Suggested answers

• Example 1 is weak because it uses a common numeric sequence.
• Example 2 is predictable because it combines a common word with a year and symbol.
• Example 3 is longer and uses unrelated words, but it remains a public teaching example and must not be adopted as a real password.
• Example 4 supports the use of unique, randomly generated passwords without requiring users to memorize each one.
• The fictional student should stop reusing the email password, replace the predictable school password, retain unique passwords for other accounts, and strengthen the password manager’s master password.

Expected learning outcome: You should be able to explain what makes a password stronger, recognize the risks of password reuse, and develop a safe plan for protecting your accounts.

NEXT LESSON

Please follow and like us: