What is a password?
Definition
A password is a secret string of characters, such as letters, numbers and symbols, that you use to prove you are who you say you are and to get into an account, device or service.
- Category
- Security
- Also called
- passcode, memorized secret, passphrase
- Last updated
A password is something you know. You type it, the service compares it with what it has stored, and if they match you're let in. NIST's glossary defines it as a string of characters used to verify identity or authorise access, and its digital identity guidelines call it a memorized secret.
A passphrase is a longer password made of a sequence of words. A PIN is a memorized secret that usually has only digits.
How passwords get stolen
A password can be guessed, cracked, phished or taken from a breach. NIST describes password cracking as recovering secret passwords stored in or sent across a computer system. If you reuse the same password, one leaked copy opens every account that shares it. CISA warns that if attackers guess one of your passwords, they can get into other accounts that use it.
What makes a good one
CISA says passwords should be long, random and unique, and suggests at least 16 characters. The FTC suggests at least 12. CISA also describes a passphrase of four to seven unrelated words as a memorable alternative, and advises against common phrases, song lyrics and movie quotes.
NIST advises against requiring people to use a mix of character types and against forcing changes for no reason. Sites are meant to check new passwords against lists of commonly used or compromised ones.
Passwords aren't enough alone
A password is one factor. Adding a second one, such as a code from an app or a security key, means a stolen password isn't enough to get in. See two-factor authentication.
How to protect yourself
- 1
Use a password manager
It creates and stores a long, random password for every account, so you only remember one. CISA suggests choosing one that offers multi-factor authentication and checking how account recovery works before you rely on it.
- 2
Never reuse passwords
Reuse turns a single breach into several. Change any password you've used in more than one place, starting with email and banking.
- 3
Turn on two-factor authentication
Use an authenticator app or security key where you can, especially on email, which can reset your other accounts.
- 4
Check whether yours has leaked
If an account appears in a breach, change that password and anywhere you reused it. Serus monitors breach databases and the dark web and alerts you when your details appear.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
How long should a password be?
CISA recommends at least 16 characters and the FTC suggests at least 12. Longer and unique to the account is better.
What is the difference between a password and a passphrase?
A passphrase is a longer password made from a sequence of words, such as four to seven unrelated ones. It's easier to remember than a random string.
How do I remove a password from a phone or account?
On most devices it's under security or lock screen settings, where you can choose to turn the password off after entering it. Doing so lets anyone with the device in hand get in, so only do it if you have another protection in place.
Sources
Something wrong or out of date? Tell us and we'll re-check it.