Beginner level · Module 1: Passwords, MFA and Account Safety · Lesson 2 of 3
Passphrases and Password Managers
Create strong passwords you do not have to remember by using a password manager.
In this lesson you will
- Create a strong passphrase
- Set up and use a password manager
Key concepts
length and randomnesspassphrasespassword managersmaster password
The lesson
Strength comes mainly from length and randomness. Four or five random words, chosen by a generator rather than by you, make a passphrase that is long yet memorable.
A password manager such as Bitwarden generates and stores a unique random password for every site, fills them in and syncs between devices. You remember only one strong master passphrase.
Protect the password manager itself with a strong passphrase and multi-factor authentication, and keep its recovery information somewhere safe and offline.
Step by step
- Generate a passphrase for the password manager.
- Install a password manager on a computer and phone.
- Move three accounts into it with new generated passwords.
- Test signing in with the stored passwords.
How long does a password survive a cracking attempt?
Comparing random characters and random-word passphrases by the number of guesses an attacker needs.
| Item | Working | Amount |
|---|---|---|
| 8 random characters (a–z, A–Z, 0–9) | 62⁸ ≈ 2.2 × 10¹⁴ possibilities (47.6 bits) | about 3 hours |
| 4 random words from a 7,776-word list | 7,776⁴ ≈ 3.7 × 10¹⁵ (51.7 bits) | about 2 days |
| 5 random words from a 7,776-word list | 7,776⁵ ≈ 2.8 × 10¹⁹ (64.6 bits) | about 45 years |
| 12 random characters (a–z, A–Z, 0–9) | 62¹² ≈ 3.2 × 10²¹ (71.5 bits) | about 5,000 years |
Explanation
Average time is half the possibilities divided by the guessing rate: an attacker finds the password, on average, halfway through. Each extra random word multiplies the work by 7,776.
This only holds for passwords chosen randomly by a generator. A 'clever' human password such as Juba2026! is guessed far faster because attackers try common patterns first — which is why password managers generate passwords for you.
Check your understanding
62⁸ ÷ 2 ÷ 10¹⁰ ≈ 10,900 seconds ≈ 3.0 hours; 7,776⁵ ÷ 2 ÷ 10¹⁰ ≈ 1.42 × 10⁹ seconds ≈ 45 years.
Practice activity
Move your five highest-risk accounts into a password manager with new unique passwords.
Expected result: Five accounts with unique generated passwords stored in the manager.
Check your understanding
-
What makes a password strong?
Show answer
Length and randomness, and not being reused.
-
What must you protect most carefully when using a password manager?
Show answer
The master passphrase and the manager's recovery details.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.