Password Strength and Policies
Understand what makes a password strong and how password policies reduce risk.
Password Strength and Policies is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Passwords Still Matter
Despite the rise of MFA and passwordless authentication, passwords remain the most common authentication factor. A weak password is the most common point of initial access in breaches.
What Makes a Password Strong?
Strong passwords have:
- Length — 16+ characters significantly increases entropy
- Complexity — mix of uppercase, lowercase, numbers, symbols
- Unpredictability — no dictionary words, keyboard patterns, or personal info
- Uniqueness — different password for every account
Password Entropy
Entropy measures unpredictability in bits. A password using 94 printable ASCII characters: each character adds ~6.5 bits. A 16-character password has ~104 bits of entropy — practically uncrackable by brute force.
Length beats complexity: "correcthorsebatterystaple" > "P@ss1".
Common Password Mistakes
Attackers know users choose:
- Dictionary words with simple substitutions (p@ssw0rd)
- Personal info (birthdate, pet name)
- Keyboard patterns (qwerty, 123456)
- Company name + year
- The same password everywhere
Password Policies
Effective password policies (per NIST SP 800-63B):
- Minimum 8+ characters (12+ preferred)
- Check against known-breached password lists
- Do NOT require frequent mandatory rotation (encourages weak passwords)
- Do NOT require arbitrary complexity rules that users game
- Allow paste to enable password managers
Password Managers
A password manager generates and stores unique, strong passwords for every account behind one master password. This eliminates password reuse — the root cause of credential stuffing.
Popular options: Bitwarden (open source), 1Password, KeePass, Dashlane.
Passphrase Approach
A passphrase — four or more random words — combines memorability with high entropy. "TrafficLampFrogBridge" is more secure than "T!@#k7" and far easier to remember and type.
Corporate Password Policies
For enterprise environments:
- Enforce minimum length via Group Policy / IdP
- Block commonly used passwords (top 100,000 list)
- Enable MFA for all accounts
- Monitor for password spray and brute-force patterns in logs
- Use LAPS for local admin password rotation
Checking Passwords Against Breach Databases
HaveIBeenPwned (HIBP) by Troy Hunt contains billions of stolen credentials. Organizations can use the HIBP API to block passwords found in known breaches.
Users can check their email at haveibeenpwned.com.
Biometrics vs Passwords
Biometrics (fingerprint, face) are convenient but have limitations: they cannot be changed if compromised. They are best used as a second factor alongside a strong password, not as a replacement.
The Future: Passwordless
Passkeys (FIDO2/WebAuthn) are replacing passwords with cryptographic key pairs. The private key never leaves the device. Phishing-resistant by design — no password to steal. Adopted by Apple, Google, and Microsoft.
Quick Check: Password Strength
According to NIST SP 800-63B, which practice is recommended to improve password security?
Lesson Recap
Strong passwords rely on length and uniqueness more than complex character rules. Password managers solve the reuse problem. NIST guidelines recommend checking against breach databases rather than forcing frequent rotation. Passkeys (FIDO2) are the phishing-resistant future of authentication.
Frequently asked questions
Is the “Password Strength and Policies” lesson free?
Yes — the full text of “Password Strength and Policies” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Password Strength and Policies”?
Understand what makes a password strong and how password policies reduce risk. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Password Strength and Policies” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Password Strength and Policies
- Password Hashing: bcrypt, Argon2, PBKDF2
- Multi-Factor Authentication
- Credential Stuffing and Password Spraying