Create a truly strong password: the 4-random-words method

01 / 04The problem P@ssw0rd! protects nothing anymore

Part 1 — the problem.

8 characters = 4 minutes

In 2026, a computer can test billions of combinations per second. An eight-character password — even with numbers and symbols — falls in four minutes. And P@ssw0rd!? Hackers have dictionaries that cover every classic substitution. The letter E replaced by 3, A by @, S by $ — these tricks have been known for twenty years.

Substitutions fool no one anymore

The real measure of a password is entropy — the number of possible combinations. A dictionary word with basic substitutions has low entropy. Replacing letters with numbers doesn't genuinely multiply the possibilities. What matters is length and unpredictability. The longer and more random your password, the more cracking becomes mathematically impossible.

02 / 04The passphrase method 4 random words = 100+ years to crack

Part 2 — the solution.

4 random words: umbrella-planet-whale-bicycle

The method recommended by NIST and major cybersecurity agencies is called a passphrase. You take four random words — not a quote, not a known phrase — and chain them together. Umbrella, planet, whale, bicycle. This kind of password contains over fifty bits of entropy. Result: several centuries to crack.

Why random = essential

Important: the four words must be genuinely random. Not 'my dog is named Buddy' — that's a memorable phrase, therefore predictable. To find truly random words, roll a dice, use an online word generator, or simply open a dictionary to random pages. The more improbable the combination, the stronger the passphrase.

Easy to remember, impossible to crack

The benefit of a passphrase: your brain remembers images. Picture a pair of pants on the moon, with a whale riding a bicycle. It's absurd, so it sticks. And for sites that require numbers or symbols, just add a digit and an exclamation mark at the end. Length is still the real strength.

03 / 04One account, one password the rule 85% of people ignore

Part 3 — the reuse rule.

1 site hacked = all your accounts exposed

Now the most important rule: one unique password per account. When a site gets hacked — and it happens all the time — hackers test your email and password on dozens of other sites. This is called credential stuffing. One weak link is enough to compromise everything.

85% of breaches = password reuse

According to the Verizon Data Breach report, over eighty percent of compromised accounts involve a reused or stolen password. It's not always your password that leaks — it's the same one from another site. When your email and password appear in a hacked database, they're resold and tested everywhere within hours.

04 / 04The password manager already in your phone — free

Part 4 — the practical solution.

Built-in manager: your phone already has one

Good news: you don't need a paid app. Your iPhone or Android has a built-in password manager — Keychain on iOS, Google Password Manager on Android. It generates strong passwords for you, remembers them, and fills them in automatically. You only need to remember one password: your phone's.

Two-factor auth: 30 seconds to activate

On top of a strong password, activate two-factor authentication on your most important accounts. Email, banking, social media. It's the second lock: even if your password leaks, the attacker gets blocked by the code sent to your phone. It takes thirty seconds to set up and multiplies your protection by a hundred.

Priority: email > bank > social media

Where to start? Your email account is the master key — if an attacker gets in, they can reset all your other passwords. Start there. Then your bank. Then social media. For each account, generate a unique passphrase or let your built-in manager create one. You can go account by account, at your own pace — ten minutes a day is enough.