Use a password manager
One strong master passphrase, and a unique random password everywhere else. Reuse is how one breach becomes ten.
How long would it last?
Type a password and watch how real attackers would come at it, from a throttled login page to an eight-GPU cracking rig. Nothing you type is stored or sent, and the breach check only ever shares five characters of a hash.
waiting for input
// breach check
Has it leaked before?
Checks Have I Been Pwned's database of over a billion breached passwords using k-anonymity: your browser hashes the password, sends only the first five characters of the hash, and finds the match itself in the list that comes back.
- 1 · your browserpassword → SHA-1
••••••••••••••••••••••••••••••••••••••• - 2 · sent to the APIonly the first 5 characters
••••• - 3 · returned~800+ hash suffixes that share that prefix, padded with decoys
… - 4 · your browserlooks for its own suffix in the list
–
// passphrase generator
Random words
2,336-word list · crypto.getRandomValues with rejection sampling
// random password
For your password manager
The short version
Turn on MFA, ideally phishing-resistant
Passkeys, FIDO2 keys or number-matching push. SMS codes are better than nothing, not much better than that.
Length beats complexity
Four or five random words outlast "P@ssw0rd!" by centuries. Complexity rules mostly produce predictable substitutions.
Follow NIST SP 800-63B
No forced periodic resets, no composition rules, at least 15 characters for single-factor passwords, and screen new passwords against breach lists like this one.