Opinion: We should all be using more secure passwords – and changing them more often

Don’t use personal information in your passwords. — Jim Rossman/TNS

Where I work, we are required to change our passwords once a year. This is an important password, as it is used to log into our PCs and unlock just about everything we do on our network, like check email or log in to see our pay stubs or sign up for benefits.

I get asked a lot about creating a strong password, and I do have some tips you can use to make your passwords more secure and easier to remember.

Don’t use personal information in your passwords. This includes names of your spouse, kids, pets, year you were born or graduated high school, hometown or type of car you drive. These words can usually be found in your social media posts or other places online.

Don’t use words found in the dictionary. There are password-guessing apps that can try millions of combinations of words found in the dictionary. It's good to purposefully misspell words in your password. Use a zero instead of the letter "O," or drop the vowels out of a word.

Use numbers and symbols throughout your password.

Use a simple phrase that is something you can remember, then change it up just enough to make it harder to crack. Remember, longer passwords are much harder to crack. I’d say eight characters are the minimum. I personally use at least a 17-character passphrase. I also use a symbol (like a hyphen) between the words.

For example, I’m a barbecue lover, so an easy-to-remember passphrase for me might start out with “wood smoke for good ribs,” but I’d change it up to add capital letters, numbers and symbols.

A more secure version would be "W0od-sm0ke-4-go0d-rib$," which is the same phrase, but I capitalized the "W," substituted a zero for "O" twice, but not every time, used the number "4" instead of the word “for,” used the "$" instead of an "S," and I put hyphens between every word.

This example contains five words, but none are straight-out dictionary words. A password-cracking program would take centuries to guess it.

You can test the strength of your passwords using a password strength calculator like the one at bitwarden.com/password-strength. If you are worried about testing your password there, Bitwarden is a trusted company, and they say your password is not transmitted to their server. Instead, it is evaluated locally using just the secure browser window.

You might also consider a password manager like Bitwarden, Dashlane, 1Password or LastPass. For these, you just have to make one master password, then the app creates strong passwords for all your websites. Some have free tiers, but they all charge if you want more features, like password-syncing between devices.

Some other password tips to remember include: Don’t use the same password for multiple sites. Change your passwords regularly (at least annually, if not more often), and enable two-factor authentication on every website or app if available. Two-factor means you set up an email address or cell number and whenever you log in, after you enter the correct password, the site will email or text you a code you must enter to complete the login.

Oh, and it is fine to write down your passwords, just don’t keep your list anywhere near your computer. And don’t label it “my passwords.” – Tribune News Service