Passwords & Accounts · Try it yourself
How fast could a criminal guess your password?
Try it in three steps. It takes about a minute.
Step 1
Make up a password the way most people do
A pet’s name, a year, a symbol on the end. Maybe swap a letter for @ or $.
Make one up. Don’t type a real password.
More ideas:
Step 2
Watch a criminal’s computer guess it
Step 3
Now try a password made by a password manager
This is the kind of password your phone, browser or password manager makes for you, and remembers so you don’t have to.
What this means for you
Pet names, years, and swapping a for @ feel clever, but everyone does it, so guessing programs try those first. A password nobody chose is the one they can’t guess.
- Let your phone or browser make your passwords. When a site asks for a new password, accept the strong one it suggests. It saves it for you.
- Start with your email. Whoever gets into your email can reset every other password.
- Never use the same password twice. One leak shouldn’t open everything.
How we figured the times: we assume a criminal has stolen a poorly protected password file and uses one fast computer making 10 billion guesses a second. That happens in real data breaches. The guesses start with popular pet names and common passwords, then add capitals, swaps like @ for a, years and symbols. Real guessing lists are much bigger than ours. Nothing you type leaves this page. Sources: CISA · FTC