Training module
Accounts and passwords
Why length beats complexity, why reuse is the real danger, and how a password manager fits into daily life.
What you will be able to do
- Explain why a long passphrase is stronger than a short complex password.
- Describe what happens to every account when one password is reused.
- Start using a password manager with a sound master password.
What a password has to withstand
A password faces two different situations. Online, a service can slow guesses down, lock the account after repeated failures and ask for a second factor. Offline, after a service's database has leaked, an attacker can try guesses as fast as their hardware allows, with no lock-out. Both situations are why the password has to be long and unique.
Length matters more than symbols
Each extra character multiplies the number of possibilities. Current NIST guidance (SP 800-63B-4, 2025) therefore asks for at least 15 characters when a password is the only factor, asks services to accept passwords of at least 64 characters, and rules out forced periodic changes unless there is evidence of compromise. A passphrase of four or five unrelated words is easy to remember and has more possibilities than an eight-character mix of symbols that people usually build in predictable ways.
The password tool in this section shows the arithmetic for any length and character set.
Reuse is the real danger
When one site is breached, the leaked e-mail and password pairs are tried automatically on other services. This is credential stuffing, and it works only on people who reuse passwords. A strong password used in two places is protected only as well as the weaker of the two sites. The rule is simple: one unique password per account.
A password manager makes the rule practical
Nobody can remember dozens of unique passwords, and that is the job of a password manager. It generates a random password for each account and fills it in. It has a useful side effect: it fills only on the exact site it saved the password for, so a lookalike domain gets nothing. You then remember one thing, the master password, which should be a long passphrase used nowhere else.
- Start with the accounts that can reset others: your main e-mail, then banking, then cloud storage.
- Turn on multi-factor authentication for the manager itself.
- Store the recovery key or emergency kit on paper, in a safe place.
Choosing the master password
Pick four or five unrelated words, preferably chosen at random rather than from a song or a saying. Do not use personal facts such as names, birth dates or places, which others can find or guess. Write it down once while you learn it, then destroy the note.
Key points
- Length and uniqueness matter more than symbols.
- Never reuse a password; a manager makes that possible.
- The master password is the one you memorise: long and used nowhere else.
Check yourself
Choose an answer to see the explanation. You can start again at any time.
1. Which password is hardest to guess, assuming both are chosen at random?
Length multiplies the possibilities faster than extra character types, and a simple substitution in a known word is a pattern guessers try first.
2. A small forum you joined years ago leaks its user list. What is the main risk?
Leaked pairs are tried automatically elsewhere. Reuse is what turns one leak into many compromised accounts.
3. Your password manager refuses to fill a password on a page that looks like your bank. What is the most likely reason?
Managers match the exact domain. A refusal on a page that looks right is a reason to stop and check the address.
4. Which is the sound way to handle the master password?
The master password protects everything else, so it must be unique, and a recovery key avoids lock-out without weakening it.
Go further
Sources
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).