Internet & Identity · lesson 8 of 17 · 15 min
Strong vs. weak passwords
Not all passwords are equally safe. A weak password is one that is easy for a person — or a computer program — to guess. A strong password is long, uses a mix of different types of characters, and is hard for anyone to figure out. The difference between a weak and a strong password can mean the difference between a safe account and a hacked one.
Hackers use special programs that can try thousands of passwords per second. These programs start with the most common passwords — like “password,” “123456,” and “qwerty” — and then try combinations of names, birthdays, and dictionary words. A weak password can be cracked in seconds. A strong password could take millions of years to crack.
❌ Weak passwords
- password
- 123456
- yourname2010
- abc123
- iloveyou
These can be cracked in under 1 second.
✅ Strong passwords
Tr0ub4dor&3!
- C@t$Jump!High7
- Purple#Rain99x
M0unt@in$Sky!
These would take millions of years to crack.
The four ingredients of a strong password
A strong password uses four types of characters mixed together. Think of it like a recipe — you need all four ingredients to make it work:
- Lowercase letters
- a, b, c, x, y, z
- Regular small letters
- Uppercase letters
- A, B, C, X, Y, Z
- Capital letters
- Numbers
- 0, 1, 2, 7, 8, 9
- Digits mixed in
- Special characters
- ! @ # $ % & *
- Symbols that add complexity
Length matters most! A password that is 16 characters long is much stronger than an 8-character password, even if the short one uses all four types. Aim for at least 12 characters — longer is always better.
Passphrases — long and easy to remember
One of the best tricks for creating a strong password is to use a passphrase — a string of random words joined together. For example: PurpleTurtle!JumpsHigh7. This is long, uses all four character types, and is much easier to remember than a random jumble of letters.
The key is to pick words that are random and not related to each other or to you. Do not use your pet’s name, your favorite sports team, or your birthday — those are things people who know you might guess.
A passphrase like Cloud9!Bicycle$River is both strong and memorable. It has uppercase letters, lowercase letters, numbers, and symbols — and it is 19 characters long, which makes it extremely difficult to crack.
Key words to remember
- Weak password
- Strong password
- Passphrase
- Brute force attack
- Character types
Match each password concept to its description
Strong vs. weak passwords — quiz
Which password is the strongest?
- password123
- alex2015
- T!ger$Jump99x
- 111111
Answer: T!ger$Jump99x
T!ger$Jump99x uses uppercase, lowercase, numbers, and symbols — and is 12 characters long.
Why is using your name as a password a bad idea?
- Names are too long
- People who know you could easily guess it
- Names have too many letters
- It’s actually fine
Answer: People who know you could easily guess it
Using your name makes your password easy for others to guess — especially people who know you.
What is a passphrase?
- A very short password
- Several random words joined together as a password
- Your pet’s name
- A password hint
Answer: Several random words joined together as a password
A passphrase uses multiple random words — making it long, strong, and easier to remember.
A 16-character password is stronger than an 8-character password, even if both use all four character types.
- True
- False
Answer: True
Length is one of the most important factors in password strength. Longer passwords take exponentially longer to crack.
What is a brute force attack?
- Physically breaking a computer
- A program trying thousands of passwords per second
- Guessing a password by knowing the person
- Stealing a password by looking over someone’s shoulder
Answer: A program trying thousands of passwords per second
Brute force attacks use programs to try huge numbers of password combinations very quickly.
Which of these is the best passphrase?
- ilovecats
- myname2010
- Blue9!Elephant$Storm
- abc123
Answer: Blue9!Elephant$Storm
Blue9!Elephant$Storm uses random unrelated words, a number, and special characters — making it long and strong.
“123456” is a strong password because it uses numbers.
- True
- False
Answer: False
“123456” is one of the most common passwords in the world and can be cracked in under a second.
What are the four types of characters used in strong passwords?
- Letters, spaces, emojis, and colors
- Uppercase, lowercase, numbers, and special characters
- Short words, long words, names, and dates
- Vowels, consonants, digits, and punctuation
Answer: Uppercase, lowercase, numbers, and special characters
Strong passwords mix all four: uppercase letters, lowercase letters, numbers, and special characters like ! @ # $.
Why should you avoid using your birthday in a password?
- Birthdays are too long
- People who know you might guess it
- Passwords cannot contain numbers
- Birthdays change every year
Answer: People who know you might guess it
Personal information like birthdays is easy for people who know you — or who can find it online — to guess.
What is the minimum number of characters recommended for a strong password?
- 4
- 6
- 8
- 12
Answer: 12
Aim for at least 12 characters. Longer passwords are much harder to crack — 16 or more is even better.
Previous lesson: What is a password?
Back to Internet & Identity
Next lesson: Why passwords should be private