Passwords

A password is a secret value that must be typed before a system allows access. This is authentication: the system checks that whoever is asking for access knows something that only the account holder should know. If the value typed does not match the stored one, access is refused.

What makes a password strong

A strong password is long and mixes upper and lower case letters, digits and symbols. Length matters because every extra character multiplies the number of combinations an attacker must work through, and mixing character types has the same effect. Compare pony with Pony7!stable: a program can work through every possible four-character password in seconds, but the longer mixed password has far too many possible forms to work through quickly.

Resisting brute-force attacks

A brute-force attack tries password after password until one is accepted. Strong passwords make this approach impractical, and account lockout supports them: once several guesses in a row fail, the system refuses further tries for a short time. Without that limit, a fast program could send thousands of guesses a minute; with it, the attacker runs out of attempts long before the password is found.

Social engineering and the limits of passwords

Strong passwords also limit one route for social engineering, where someone tricks a person into giving away information. An attacker who knows your birthday or your pet's name may guess a password built from them, so a long, random password that avoids personal details cannot be worked out that way. A strong password does not stop you being tricked into telling someone what it is, though, so technical methods alone cannot fully stop social engineering.

Passwords do not stop every threat. Malware can record keystrokes or copy files whatever the password is, a denial-of-service attack floods a service with traffic and never needs one, and SQL injection abuses a badly written web form rather than an account. Passwords are one prevention method, so they are used with others such as user access levels, anti-malware software and firewalls.