A good password isn't everything, but it's still the first thing that separates your accounts from prying eyes.
And given the number of services we use (email, social networks, online shops, banking, various and sundry forums…), it's best to avoid protecting all of that with a glorious 123456.
One question remains: how can you tell if your password is really strong?
There are websites that can assign it a score or proudly announce that it would take billions of years to crack. It's fun to watch, perhaps even informative, but not necessarily a good reason to entrust them with your real email password.
Is it really a good idea to test your password online?
I would tend to answer: meh.
Some tools perform their calculations directly in your browser, without sending the password to a server. That's already quite reassuring.
But unless you know exactly how the site works and trust it, I don't really see the point in entering the account password important just to get a nice green gauge.
If you want to do the test, use instead a fake password built on the same principle as yoursYou will be able to see how the tool reacts without giving it the original.
And don't be too impressed by the "strong password" verdict.
You can have a beautiful green bar and still use a bad password if it is reused on ten sites or constructed in a predictable way.
So, what makes a good password?
Thankfully, we are gradually moving away from the era when it was absolutely necessary to include a capital letter, three numbers, and a special character to produce a magnificent M0tDeP@ss3!.
Today, Length matters a lot.
For mot de passe Used alone, NIST recommends, for example, a minimum of 15 characters . For its part, ANSSI cites a minimum of 12 characters in its security rules intended for the general public.
A passphrase can therefore be much more practical. A few sufficiently long and difficult-to-guess words are often easier to remember than a jumble of letters, numbers, and special characters.
But there is something even more important: a different password for each account.
Because using an ultra-strong password everywhere is still a bad idea.
Imagine using the same account for your email, Amazon, your favorite social network, and that little forum you joined three years ago. If one of these services has its database stolen, your login credentials could then be used elsewhere.
And no, there's no need to change all your passwords every three months just for the fun of it.
NIST advises against requiring periodic password changes when there is no specific reason to do so. However, if a password has been compromised or you suspect a data breach, there's no hesitation: change it.
A password manager to avoid going crazy
At this point, you can probably see the problem coming.
Long, complicated passwords that are difficult to guess and, above all, different for each account, are great. Remembering 40 of them, much less so.
This is where password managers become really practical (See our article on the best password managers)
Bitwarden, 1Password and other similar solutions may generate passwords complex passwords and keep them safe for you. This way, you can have a different password for each service without turning your brain into a vault.
You keep your master password, the manager takes care of the collection.
ANSSI also recommends the use of a password vault.
And while we're at it, strengthening the security of your accountsAlso activate themulti-factor authentication (MFA) When offered, it adds an extra verification step beyond the password. So, if the password is leaked, it won't necessarily be enough for someone to access your account.
In short, there's no need to spend hours searching for the "perfect" password in an online test. Instead, make your passwords long, use a different password for each account, have a manager remember them for you, and activate MFA when it's available.
You will have already done a good part of the work.
