Close this search box.

Tips for Strong Passwords

Strong Password Tips

Yes, we know what you’re thinking… you’re already juggling more online logins than you ever thought imaginable and you’d rather not spend any more time thinking about them. That’s fair. But the truth is, the passwords you choose and how you manage them have serious implications on a global scale: stolen credentials are the #1 entry point for cybercriminals.

At SpyCloud, we spend a lot of time thinking about passwords because their misuse has proven to be one of the most persistent contributing factors to the increase in cybercrime. We also know that passwords aren’t going away anytime soon. Here, we offer our top 5 tips for stronger passwords and – stronger account protection overall.

Choose a Complex, 16+ Character Password or Passphrase
Is your password exposed?

Test any password to see how many times it has appeared on the darknet.

By now, you would think all the advice about the importance of strong passwords would sink in. And yet, among the passwords SpyCloud recaptured from breaches last year alone, the top three were “pass,” “123456,” and “password.” If we use passwords that are easy for us to remember, they are easy for criminals to guess. This makes us vulnerable to password spraying, a brute force attack where a cybercriminal uses a list of usernames and common passwords to try to gain access to a particular site. Once they get a match, the criminal will test that same username and password combination against as many accounts as possible.

In addition, our testing revealed that passwords with 16+ random letters, numbers and characters, regardless of hashing algorithm used, would require centuries to crack. It’s a good reminder that while the way a company protects passwords is out of users’ control, we can take responsibility for our own account security by creating more complex passwords.

Make Passwords Unique Across Accounts

Given the explosion of digital services in recent years and the global shift to remote work, most people are juggling more online logins than ever. Criminals rely on stolen credentials to perpetrate fraud and they act on the assumption that if you use a password for one account, you probably use the same password for another. But despite widespread education on this topic, for the last two years, SpyCloud observed a 70% password reuse rate in our recaptured breach data — so it appears the problem isn’t getting better. The introduction of automated credential stuffing tools has made it easy for criminals to test credential pairs against a number of websites to see which additional accounts they can take over; hence why password reuse is so dangerous.

Make it easy on yourself: use a password manager to generate and store unique passwords for your hundreds of online logins.

Don’t Mix Business Logins with Personal Accounts

64% of Fortune 1000 employees are reusing passwords across work and personal accounts. While this problem seems similar to the one above, the nuance here is that carelessness at home puts employers at risk. If your streaming or gaming account is compromised and you’re guilty of reusing passwords (even variations of those passwords), it’s possible for cybercriminals to access more of your personal and professional accounts.

Use Multi-Factor Authentication

When first introduced, multi-factor authentication (MFA) was sold as a “magic bullet” designed to plug the gaps in password security. Requiring users to provide something they know (a password) plus something they are (biometrics) or something they have (smartphone token) is an important layer of protection and will deter some cyber attacks. Like all deterrents, criminals have found ways to bypass it, but that doesn’t mean you shouldn’t use it.

Lean Into NIST Guidelines

The National Institute for Standards and Technology (NIST) develops rules by which federal agencies must comply, but those guidelines are helpful for private sector organizations as well. One of the most critical aspects of NIST guidance when it comes to password security is to restrict the use of passwords contained in previous breach corpuses. This means that any password that has been exposed in a data breach – no matter how complex – should be banned.

While enterprises can enforce many NIST guidelines through the built-in settings provided by most directory services (including Microsoft Active Directory), comparing passwords to an ever-evolving list of exposed passwords is not out-of-the-box functionality, and comparing passwords to a static list will not satisfy NIST’s guidance. New breaches happen all the time, continually adding to your organization’s risk exposure, so consider third-party services to enhance Active Directory’s capabilities in this regard.


With online services getting breached on a regular basis, leaked/stolen passwords pose a severe threat if we continue reusing passwords. Password managers are important and so is continuous monitoring for exposed credentials, but for organizations, educating users on the risks of poor password hygiene is also critical. If there is one variable cybersecurity measures can’t address, it’s human behavior. However, these practices and tips can serve as first steps toward building a strong password framework for yourself and your organization.

Do you know if your data has been exposed? Check your exposure here – simply enter your email address and we can tell you how many times your credentials have been found in third-party data breaches recaptured by SpyCloud on the criminal underground, as well as how recently your data was exposed.
Recent Posts

Check Your Company's Exposure

See your real-time exposure details powered by SpyCloud.

[What’s New] Check Your Exposure has been expanded with more recaptured data. See Your Results Now

Close this search box.