83% of data breaches involve weak or reused passwords. Here is the modern method to create a secure password and effectively protect all your online accounts.
The fundamental rules of a secure password in 2025
A strong password should contain at least 12 characters (ideally 16+), mix uppercase and lowercase letters, numbers and special symbols, avoid personal information and be unique for each account.
The “8 characters minimum” rule has been obsolete since 2020. Hackers crack an 8-character password in under 2 hours with modern computers, compared with several years for 12+ characters.
Ban these for good: dates of birth, family or pet names, simple sequences (123456, qwerty), single dictionary words and reusing passwords across sites. These practices account for 90% of hacked passwords.
Passphrases are becoming the standard: “MyCat@Eats3Biscuits!” is far more secure than “MyC@t!” while remaining memorable for the user.
The personalised mnemonic phrase method
Choose a memorable personal sentence: “I was born in 1985 in Paris and I love chocolate”. Turn it into an acronym: “Iwbi1985iPaIlc”.
Strengthen it with substitutions: replace some letters with consistent numbers or symbols: “Iwb!1985!P@Ilc”. The “i” becomes “!”, the “a” becomes “@”.
Adapt it for each site: add a unique marker for each platform. For Gmail: “Iwb!1985!P@Ilc-Gm”, for Facebook: “Iwb!1985!P@Ilc-Fb”.
This method generates unique passwords of 15-20 characters that are easy to remember but impossible to guess, even for people close to you who know the original sentence.
Password generators: recommended tools
Bitwarden (free) generates passwords up to 128 characters long with customisable settings: length, character types and exclusion of ambiguous characters (0/O, 1/l).
1Password and Dashlane offer similar generators built into their managers. Avoid little-known online generators that could keep your passwords.
Recommended settings: at least 16 characters, all categories enabled (uppercase, lowercase, numbers, symbols) and ambiguous characters excluded to avoid typing errors.
Browsers (Chrome, Firefox, Edge) include basic generators that are good enough for occasional use, but less configurable than dedicated solutions.
You can also use the CNIL password generator (the French data protection authority).
Testing the strength of your passwords
Have I Been Pwned (haveibeenpwned.com) checks whether your password appears in hacked databases. NEVER enter your current password there, only old ones.
Strength calculators such as those from Bitwarden or Kaspersky estimate how long it would take to crack your password by brute force. Aim for at least “100 years” for decent security.
A practical test: if you can easily memorise your password in fewer than 3 repetitions, it is probably too simple. A good password takes 5-10 repetitions to remember.
Avoid unknown testing sites that could secretly record your passwords for malicious purposes.
Password managers: the essential tool
A password manager stores and automatically generates unique passwords for each account. You only need to remember one ultra-secure master password.
Recommended solutions: Bitwarden (free, open source), 1Password (paid, excellent interface), KeePass (free, local). Avoid browser password managers for sensitive accounts.
The manager fills in your credentials automatically, eliminates typos and alerts you if a site has been hacked. Time savings and maximum security combined.
Multi-device sync: your passwords stay accessible on PC, smartphone and tablet, with end-to-end encryption for optimal protection.
Two-factor authentication: extra protection
Even with a perfect password, enable two-factor authentication (2FA) on all your important accounts: banks, email, social networks, cloud.
Prefer authenticator apps (Google Authenticator, Authy) over SMS, which is more vulnerable to SIM swapping attacks. The codes change every 30 seconds for stronger security.
According to Microsoft, this double protection blocks 99.9% of account takeover attempts, even if your password is exposed in a data breach.
Leave a Reply