We all know that the more complicated a password is, the better. They should include a mixture of numbers, punctuation marks and symbols, and upper- and lower-case letters.

Or should they?

Recent research into password security has shown that much of conventional password wisdom is not only wrong, but possibly dangerous.¹

Facebook, Twitter, Yahoo, and LinkedIn have all fallen prey to online attackers who have stolen entire databases full of passwords. The passwords are scrambled for security, but this offers little comfort when computer programs can make millions of guesses in just a few hours. Because most passwords are based on words in a dictionary combined with a number or symbol, it can take these sophisticated programs even less time to hack them.

The end result is that common password policies don't prevent the theft of many users' passwords, creating a complex, sophisticated, and lucrative shadow industry. Strangely enough, breached passwords can fetch big money on the black market.²

So, what does that mean to you? It means that every password you’ve created is a valuable and vulnerable commodity worth protecting.

To do so, you should go a step beyond choosing passwords that are hard for a human to guess. Your passwords also need to be difficult for a computer to figure out. Here are some tips.

Favor Length Over Complexity

Longer passwords are more difficult to crack. Around 20 characters is recommended.³ Consider stringing together the first couple letters of a favorite movie quote, song lyric, or poem. Random words and numbers strung together are even better. For extra-sensitive accounts, it may make sense to change your passwords on a regular basis. If you like the idea of optimal password protection but worry you won’t be able to handle multiple changing passwords, password managers can help you organize, store, and use multiple passwords safely.

No Plain English

Simple strings of numbers, along with passwords that can be found in the dictionary, are the easiest to crack. Google suggests that your password should contain one or more upper- and lower-case characters, numbers, symbols and special characters.⁴

Recognize Any of These?

Take a look at the most common passwords, according to Keeper Security.⁵ If your password is one of these, it might be time to make a change.

1. 123456
2. 123456789
3. qwerty
4. 12345678
5. 111111
6. 1234567890
7. 1234567
8. password
9. 123123
10. 987654321

Mix It Up

Many people use the same password for multiple accounts because it’s easier to remember. But this could lead to serious consequences. You may not be too concerned about the personal information stored in your LinkedIn or Twitter accounts, but what would happen if hackers used your compromised password to access your email, brokerage, or bank accounts? If you have trouble remembering multiple passwords, you may want to keep a list on your computer, but don’t store it on your desktop or in your inbox. Give the file a misleading name and bury it in a folder where only you can find it.

There’s no such thing as an impregnable password. Still, putting personal information behind a basic password is like leaving your Porsche in a parking lot with your keys on the dash. By taking preventative measures to strengthen your password, you may be able to help safeguard your sensitive personal data and your privacy.

1. The Washington Post, 2017
2. Business Insider, November 13, 2017
3. ConnectSafely.org, May 4, 2018
4. Google.com, 2018
5. Keeper Security, January 13, 2017

The content is developed from sources believed to be providing accurate information. The information in this material is not intended as tax or legal advice. It may not be used for the purpose of avoiding any federal tax penalties. Please consult legal or tax professionals for specific information regarding your individual situation. This material was developed and produced by FMG Suite to provide information on a topic that may be of interest. FMG Suite is not affiliated with the named broker-dealer, state- or SEC-registered investment advisory firm. The opinions expressed and material provided are for general information, and should not be considered a solicitation for the purchase or sale of any security. Copyright 2020 FMG Suite.