# Strong password: how to check it and create one A password that is too short, or the same one everywhere, opens the door to hackers. This tutorial explains how they go about it, then shows you how to check yours and create a strong passphrase that is easy to remember. - Mini-course : Beginner - URL : https://ressources.online/outils/mot-de-passe/tutoriel/en/ - Open the tool : https://ressources.online/outils/mot-de-passe/ - Updated on 2026-09-27 ## What you will learn - Understand how hackers guess or obtain passwords. - See why length and randomness matter more than symbols. - Check a password's strength and known leaks, without ever sending it. - Create a passphrase, store it in a password manager and turn on two-factor authentication. ## Understanding passwords in 5 minutes ### How a hacker guesses a password Nobody guesses your password by thinking hard. Hackers use **programs** that try billions of possibilities, in a carefully chosen order: - **the most common passwords** first: 123456, qwerty, password, sunshine… Millions of people use the same ones; - then a **dictionary attack**: every word in the language, first names, pet names, combined with years (Fluffy1956) or with well-known “tricks”, such as @ instead of a; - finally **brute force**: every combination, one by one. It only succeeds against short passwords. On the website itself, these attempts are slow: after a few mistakes, the account is locked or makes you wait. The real danger lies elsewhere: in the theft of the site's database. ### Stolen databases and reuse: the domino effect A serious website doesn't keep your password as it is. It stores a **fingerprint** of it (also called a “hash”): a string of characters calculated from the password, which cannot be reversed. Each time you log in, the site recalculates the fingerprint of what you type and compares the two. When hackers steal these fingerprints, they run their lists at home, with no limit at all. If the site used a fingerprint that is slow to calculate (**a well-protected site**), they make slow progress. With a fast one (**a poorly protected site**), a powerful computer tests billions of guesses per second. Next comes **credential stuffing**: the hacker tries the e-mail address and password found there on other sites, such as e-mail, online shops and banks. A fictional example: the website of the “Ballon Trail Walkers” hiking club is hacked. Paul used the same password there as for his e-mail. A few days later, a stranger is reading his messages. ### Length and randomness come first Each extra character multiplies the number of combinations to try. So **length** matters far more than symbols. The usual “tricks” (a capital at the start, a year and an exclamation mark at the end) are well known to the programs: “Sunny2024!” is still a very common word. A **passphrase** strings together several words **picked at random**, for example “lantern-Walrus-violin-4-owl-hammock-lemon”. It is long, and therefore strong, and it forms a little picture that is easy to remember. The key word is **random**. A proverb, a quote or a sentence you make up yourself is predictable: the programs know songs and sayings too. Randomness is measured in **bits**: each bit doubles the number of guesses needed. A word drawn from a list of 7,776 brings almost 13 bits; six words, about 78 bits, plus a few more for the capital and the digit. By comparison, for a very powerful computer, 8 random characters can be found in a few hours; 16 characters would take millions of years. ### Data breaches and Have I Been Pwned A **data breach** happens when a website's information (e-mail addresses, passwords, sometimes postal addresses) is stolen, then published or sold. Billions of passwords are circulating this way. [Have I Been Pwned](https://haveibeenpwned.com/) is a well-known service that collects these breaches. Its public “Pwned Passwords” database lets you find out whether a password appears in them without revealing it, thanks to **k-anonymity**. Picture a library. Instead of telling the librarian the exact title of the book, you ask for “all the cards whose shelf mark starts with 5BAA6”. You are handed a pile of several hundred cards, and you look for the right one yourself. The librarian never knows which one you wanted. That is exactly what the tool does: your browser calculates the password's fingerprint (for “password”, it starts with 5BAA61E4C9…) and sends only its **first 5 characters**. The final comparison happens on your device. ### Password managers and two-factor authentication A different password for every site is impossible to remember by heart. That is the job of a **password manager**, a kind of safe. The one built into your phone or browser (Apple, Google, Firefox) does the job very well; there is also software such as Bitwarden or KeePass. It remembers everything, fills in the fields for you, and you only need to remember one main passphrase. **Two-factor authentication** (or two-step verification) adds a second lock: after the password, the site asks for a code sent by text or shown in an app, or for approval on your phone. Even if hackers know your password, they stay locked out. Turn it on for your **e-mail** first: that is what lets someone reset all your other passwords. And never give this code to anyone, not even an “adviser” on the phone. > Key takeaway : A good password is long, random and unique. A passphrase kept in a password manager, plus two-factor authentication on your e-mail: that is what really counts. ## Words to know - **Dictionary attack** : Automatically trying common words, first names and known passwords, with their usual variations (a capital, a year, @ instead of a). - **Fingerprint (hash)** : A string of characters calculated from a password that cannot be reversed. Websites store it instead of the password. - **Credential stuffing** : Automatically reusing an e-mail address and password stolen from one site to try to get into your other accounts. - **Passphrase** : A password made of several words picked at random: long, strong and easy to remember. - **Bit of randomness** : A unit measuring how unpredictable a randomly generated password is. Each extra bit doubles the number of guesses needed. - **Data breach** : The theft and release of a website's information: e-mail addresses, passwords, contact details. - **k-anonymity** : A method for checking a password against a breach database by sending only a small piece of its fingerprint, shared with hundreds of others. - **Two-factor authentication** : A second check after the password (a code by text, an app or approval on your phone), which stops hackers even if they know the password. ## Checking and creating a password step by step ### Step 1 : Open the tool, with no risk to your password Open the [Password checker](https://ressources.online/outils/mot-de-passe/). Everything is calculated **on your device**: the password is neither sent nor stored. Only the leak check, if you ask for it, sends 5 characters of its fingerprint. You don't have to type your real password. If you prefer, test one **that looks like it**: the same length, the same kind of words, digits and symbols. The result will be very close. > Tip : Never type your real password into an unknown website that offers to “test” it: it could record it. ### Step 2 : Type a password and read its level In the **Check a password** section, type or paste a password into the “Type or paste a password” field. At the first character, the tool loads its dictionary of common passwords, which takes a few seconds. A five-segment gauge appears, with a level: **Very weak**, **Weak**, **Fair**, **Strong** or **Very strong**. Next to it, “Time to guess it” gives the time needed if a well-protected site had its data stolen. Below, three situations are detailed: “By trying directly on a website”, “If a well-protected site has its data stolen” and “If a poorly protected site has its data stolen”. The last one is the harshest: a good password holds out even against that. > Tip : The eye at the end of the field shows what you are typing; the cross clears everything. ### Step 3 : Read the advice The list of advice explains the result: a green tick for what is fine, a red cross for what is a problem, an orange triangle for suggestions. With “Sunny2024!”, for example: - **length**: “10 characters: aim for at least 12”; - **a word that is too common**: “Built on a very common word or password”, followed by the word in question, here “Sunny”. Depending on the case, the tool also points out a lack of variety (“Mix letters, digits or words”), a date, a keyboard run or a substitution that is too predictable. Change the password in the field: the result updates with every character. ### Step 4 : Check whether it has already leaked In the “Has it already leaked?” box, click **Check for leaks**. Your browser calculates the password's fingerprint and sends only its first 5 characters, via our server: so Have I Been Pwned doesn't even see your IP address. There are two possible answers: - “**Warning**: this password appears … times in known leaks. Stop using it everywhere.” The level then drops to Very weak; - “**Good news**: it does not appear in any known leak.” That is still no guarantee of strength. Just below, the tool shows **the 5 characters that were sent**: you can see exactly what left your device. > Tip : If the message “Many checks in a short time” appears, wait a few minutes before trying again. ### Step 5 : Create a passphrase Scroll down to the **Create a strong password** section. The **Passphrase (recommended)** mode is selected by default and a phrase is already waiting. Adjust it as you like: - **Number of words**: from 4 to 8 (6 by default); - **Words in**: Français, English or Deutsch; - **Separator**: hyphen, dot, space or none; - **One capital letter** and **One digit**, placed at random. The English list is the EFF's list of 7,776 words; the French and German lists have 1,024 common words each, without accents, so each English word adds a little more randomness. Below the phrase, a line shows its strength, for example “about 86 bits of randomness, that is millions of years for a very powerful computer”. Don't like it? Click **New**. > Tip : Keep at least 6 words: with the English list, going from 4 to 6 words takes you from several years to millions of years. ### Step 6 : Or random characters, then copy Some sites refuse spaces or limit the length. In that case, choose **Random characters**: set the **Length** (from 8 to 40, 16 by default) and the types of characters (capitals, lower case, digits, symbols). The **No look-alike characters (O/0, l/1)** box leaves out characters that are easy to confuse, which helps if the password has to be copied by hand. When you are happy with the result: - **Copy** puts it on the clipboard (“Copied.” appears); - **Check it above** copies it into the checking field, so you can see its level. Then paste it into your password manager, and on the website concerned. > Tip : Nothing is kept: close the page and the password is gone. So save it before you leave. ## Practical cases ### The same password everywhere Monique uses “Fluffy1956”, her cat's name and her year of birth, for her e-mail, her online shopping and her knitting club's website. One day, the club announces that its website has been hacked. Rather than typing her real password, Monique tests “Kitten1957”, built the same way. In our example, the tool shows **Very weak**: a few seconds to guess it, and less than a second if the site is poorly protected. She first changes her **e-mail** password to a passphrase created by the tool, then the password for every other site, all different. She stores them in her phone's password manager and turns on two-factor authentication for her e-mail. ### The association's mailbox Karim, treasurer of the “Les Jardins de Clara” association, wants to protect the e-mail address that receives membership forms. He keeps the Passphrase mode with 6 words in English and chooses a space as the separator. The tool suggests “drum cloud Walrus hammock 2 tulip storm”: about 86 bits of randomness, that is millions of years. He clicks **Check it above**: Very strong. He saves it in the association's password manager and turns on two-factor authentication. After typing it for a few days, he knows it by heart. ### The holiday cottage Wi-Fi code At the “Gîte des Trois Épis” holiday cottage, the Wi-Fi code is still the one printed under the router. The owner wants a strong code that guests can type without mistakes. She chooses **Random characters**, 16 characters, keeps the No look-alike characters (O/0, l/1) box ticked and unticks Symbols to make typing easier on a phone. The tool still says millions of years. So that nobody has to type it at all, she turns it into a Wi-Fi QR code with the [QR code generator](https://ressources.online/outils/qr-code/), displayed in the cottage entrance. ## Common mistakes - Using the same password on several sites: a single leak is enough to open all your accounts. - Believing a symbol makes a password strong: “P@ssw0rd!” is on every hacker's list. - Making up your own “random phrase”: proverbs, quotes and song lyrics are guessed quickly. - Typing your real password into an unknown site that offers to test it: use a tool that does everything on your device, or test a password that looks like it. - Neglecting your e-mail: it lets someone reset all your other passwords, so protect it first. ## The essentials - Hackers try common passwords first, then dictionary words and their usual variations. - Length and randomness matter more than symbols: six random words make a phrase that is strong and easy to remember. - A different password for each site, kept in a password manager, and two-factor authentication on your e-mail. - The tool does everything on your device; the leak check sends only 5 characters of the fingerprint. - A password found in a leak must be changed everywhere, starting with your e-mail. ## Test yourself 1. Which of these passwords is the hardest to guess? - [ ] P@ssw0rd2024! - [x] Tulip-owl-7-lantern-storm-drum - [ ] Mary1975 Six words picked at random make a long, unpredictable phrase. The other two are based on a common word or a first name, with variations hackers know well. 2. When you click “Check for leaks”, what leaves your device? - [x] Only the first 5 characters of the password's fingerprint - [ ] The whole password, encrypted - [ ] Your e-mail address and the password That is k-anonymity: hundreds of fingerprints start with those 5 characters, and the final comparison happens on your device. 3. A club's website where you used the same password as for your e-mail has been hacked. What do you do first? - [ ] Nothing, as long as you don't notice anything unusual - [ ] Change only the club password - [x] Change your e-mail password, then the password on every site where you used it Hackers try the same e-mail and password pair everywhere. Your e-mail comes first, because it lets someone reset your other accounts. 4. What is two-factor authentication for? - [ ] So you no longer need a password - [x] To stop hackers even if they know your password - [ ] To remember all your passwords It adds a second lock: a code or approval on your phone. Remembering passwords is the password manager's job. --- Source : https://ressources.online/outils/mot-de-passe/tutoriel/en/ (Ressources.online, Password checker)