What are the best practices to create secure passwords? I would like to make them tougher to crack with brute force tools.

Part II

Are there any tools that can generate these passwords so I do not have to think one up myself?

  • 9
    Here is a strong password: hD7[lm3A8jGR If you need any more, just ask. – John Fouhy Jul 30 '09 at 2:56
  • as always, wikipedia offers good advice: en.wikipedia.org/wiki/Password – akf Jul 30 '09 at 2:57
  • 3
    not as strong now that its public ;D – John T Jul 30 '09 at 3:37
  • 2
    Now I just have to search Google for "Axxmasterr" and try hD7[lm3A8jGR on all accounts it finds. – Travis Jul 30 '09 at 16:27

10 Answers 10


On Unix systems PAM, or Pluggable Authentication Module is a nice administrative tool that comes with a crack library that you can test passwords against.

After doing some recent security work, I know that Government standards usually have these guidelines when it comes to a password:

  • Minimum Length of 14 characters
  • At least 2 special characters
  • At least 2 lower case characters
  • At least 2 upper case characters
  • At least 2 digits
  • Must be changed every 60 days
  • No dictionary words or usernames

Common sense suggests you shouldn't put the 2 numbers and special characters at the beginning or end, but interspersed. While working on these guidelines it brought up the question whether having such complex passwords was really worth it. With passwords so complex, it seems that they have a higher probability of being stored as plain text somewhere by the user or written down somewhere.

In personal use, I typically go less stringent than those guidelines, but definitely no dictionary words or L33t speak.


Bruce Schneier has a nice article on it, based on what a company has have to be common practice in people choice of passwords.

EDIT: Oh, to generate password. You can use tools such as KeePass or Password Safe to auto generate and store different good password for your logins. See this question for more information.


grc.com has a nice page where you can get strong passwords.

  • 1
    Steve Gibson is the Daddy. – Charles Roper Jul 30 '09 at 6:56
  • I have occasionally used PWD=curl https://www.grc.com/passwords.htm | openssl sha1 in scripts where I need a quick password (with error checking of the curl response) – devstopfix Sep 25 '14 at 10:21

Personally what I try to do for passwords is first think of a relatively long memorable phrase and perform the following transformation on it:

  • Include all unambiguous punctuation and the first letter of each word
  • Perform German-style capitalisation (first word and all nouns / names as capitals), or the inverse...
  • Replace some words or letters with digits, O -> 0, for / fore / four -> 4, one, an -> 1, etc.

In most cases this results in a pretty secure and unguessable password, which I can easily reconstruct myself based on these rules and remembering the phrase.

For example:

What are the guidelines for creation of a secure passwords?



Note that this scheme can be used to create passwords that fit pretty much any rules a company may have regarding minimum length, required included symbols, etc. It also has the added benefit that as long as you pick an encoding scheme that you can apply consistently because it makes sense to you (for capitals, and special characters and digits) then you should not need to write anything down on paper, avoiding the problem where a hacker might be able to find your passwords by just having a look around your workspace.

  • 1
    +1 because I also use this technique for passwords that actually matter. I might also take it a step forward and replace the letter 's' with '$' and things like that. – Sasha Chedygov Jul 30 '09 at 7:26

When security is a major factor, I always include some high ASCII characters.

For example, 154 is Ü. Not only do these characters greatly increase the amount of time required for a brute force attack, but most attacks don't even scan that character range and are sometimes not even capable of it.

Also, the obvious:

  • Longer is more secure.
  • Mix lower and uppercase, numbers, symbols.
  • Don't base it on any dictionary words, proper nouns, nor well-known meanings (i.e. acronyms).
  • +1 good tip. might have trouble with older systems tho. – quack quixote Oct 7 '09 at 6:43

The discussion at Diceware is an interesting read.

For creating high value passwords and passphrases, the technique of a dictionary like diceware's and a good randomizer such as a handful of dice is a pretty good choice.

Personally, I use PasswordSafe locked by a strong passphrase generated by the diceware technique. I let PasswordSafe generate every other password I need, and generally have no idea what they might be after a few minutes have passed. I have copies of the safe file on several systems, so I'm not too worried about all the eggs being in one basket. The big advantage is that I never knowingly use the same password for two purposes.

For personal use, I do recommend storing a legible copy of the safe's passphrase in a secure location where it could be found by your heirs...


This site outlines the guidelines well, and will allow you to test it's security. I think coming up with your own will be more memorable then a generated one as well.

  • Interesting though the test is, I can't say I agree with its algorithm. As a random test, I start typing in combination of upp/low letters & numbers. At one point I had 86%, then ADDING more letters reduced my score down to 46%. Huh? – KTC Jul 30 '09 at 3:34
  • KTC, it will reduce your score if you have repeat characters, consecutive uppercase/lowercase/numbers, sequential letters/numbers, etc. But I do agree with you that even adding the most insecure password to the END of an already secure password can't reduce it's quality. – Travis Jul 30 '09 at 16:34

The SecurityStats site has a page where you can try your password fu
It gives you guidelines on better passwords too.

Good read on the Google Enterprise Blog on password security tracking,
You could maintain an account for yourself where you check the strengths of your passwords.

because the Google Account authentication system continuously sees new variations of password attacks from around the world, we can assess password strength in real-time and help administrators spot passwords that were relatively secure in the past that are more vulnerable to the latest patterns of attacks


xkcd: Password Strength

As far as strength against brute force cracking goes, the best thing to do is increase the length and the number of possible combinations increase exponentially (literally). Of course, it's still a good idea to introduce some random characters and symbols to make dictionary attacks more difficult. Or maybe use a couple of words from different languages - bonus points for non-ASCII characters!

A more thorough analysis is available here.

And while we're looking at xkcd password advice, never reuse passwords.


See also Password Maker. This uses information you provide, including a seed, so that you can generate a unique password. Then all you have to do is remember the seed, and figure out the same data values, and Password Maker will generate the same password for you later.

My issues with passwords like that is that they are hard to type and harder to remember. Personally I have a program called gpw which generates passwords from syllable chunks, resulting in a password which is usually "almost" pronounceable. If you l33t-ify it, then add some capitalization and punctiation, you'll end up with something slightly easier to remember than line noise but is reasonably safe from brute-forcers.

So for example I'd do this:

$ gpw

I'd pick one I like, then turn it into something like ?D0ggid00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.