MyRecon OSINTPassword Security: How to Create and Manage Strong Passwords
Almost everything people are taught about passwords optimises against the wrong attack. Nobody is sitting at your login screen guessing. They already have a password of yours, from a company you had forgotten you had an account with, and they are trying it everywhere else.
The attack that actually happens
Three attacks are worth distinguishing, because the defences differ completely.
- Credential stuffing. An attacker takes email and password pairs from a breach and replays them automatically across hundreds of unrelated services. Success rates are low per attempt and enormous in aggregate. This is by a wide margin the most common way ordinary accounts are taken, and reuse is the only thing that makes it work.
- Offline cracking. A service is breached and its stored password hashes are taken. The attacker then guesses at their own machine, at whatever speed the hashing allows. Here the length and unpredictability of the password is the whole defence.
- Online guessing. Attempts against a live login form. Rate limits and lockouts make this the least productive of the three, which is exactly why it is the one everyone imagines.
Reuse is the dominant risk. A password unique to one site can only ever lose you that site.
What cracking actually looks like
Nobody starts at "aaaaaaaa" and counts upward. Modern cracking runs leaked password corpora, hundreds of millions of real passwords that real people chose, through rule engines that apply the mangling humans predictably apply. Capitalise the first letter. Append a year. Swap a for @ and o for 0. Add an exclamation mark at the end because the form demanded a symbol.
This is why P@ssw0rd1! is not a strong password despite satisfying every composition rule ever written. It is one wordlist entry plus four transformations that every rule set tries in the first seconds. Complexity theatre produces passwords that are hard for humans and trivial for software.
How fast the guessing goes depends entirely on how the breached company stored the password, which you cannot control and rarely know. Fast general-purpose hashes like MD5 and SHA-1, still found in old breaches, and the reason a 2012 leak is still yielding plaintext today, allow staggering rates on commodity hardware. Purpose-built password hashes such as bcrypt, scrypt and Argon2 are deliberately slow and memory-hungry, which is why the same password can be safe in one breach and recovered in another.
What makes a password strong
Unpredictability, and length as the cheapest way to buy it. Each additional character multiplies the search space; each substitution an attacker already expects adds close to nothing.
Two approaches work:
- Generated random strings: twenty or more characters from a password manager. Strongest, and you will never type most of them.
- Passphrases: five or six words chosen at random, not composed into a sentence. The randomness has to come from a generator or dice, not from your own mind, because a phrase you thought of follows the patterns of a language and a personality. Reserve these for the handful of passwords you must actually type from memory.
Official guidance moved to match this some years ago. Current NIST recommendations tell services to allow long passwords and pasting, to stop imposing composition rules, to stop forcing periodic expiry, and instead to screen new passwords against lists of known-breached ones. Forced ninety-day rotation was withdrawn for a measured reason: it produced Summer2024! followed by Autumn2024!, which is worse than leaving a strong password alone.
Change a password when there is a reason, not on a calendar. A reason means: the service was breached, the password appears in a breach corpus, you reused it somewhere that was breached, you typed it on a device you no longer trust, or you shared it with someone. Rotation without a trigger costs effort and buys nothing, and the effort is spent on the accounts that least need it.
Password managers, including the honest objection
A password manager stores an encrypted vault. The encryption key is derived from your master password, which good implementations never transmit, the provider stores a blob they cannot read. That is what lets you have a different long random password everywhere without remembering any of them.
The objection is real and deserves a real answer: it is one basket. The 2022 LastPass incident is the case study, because encrypted customer vaults were actually stolen, and what happened next depended entirely on how strong each individual's master password was and how many iterations their account had been configured with. Vaults behind weak master passwords were subsequently cracked offline, with consequences that were severe for people storing cryptocurrency keys. The case file covers what went wrong.
The conclusion is not to avoid managers. Across any realistic population, reuse causes vastly more account compromise than vault theft, and the same incident showed that a long, unique master password held even against attackers with the vault in hand. The conclusion is that the master password is the one you must get right.
- Long, random, unique, and never used anywhere else. A generated passphrase of five or six words is the right shape, because you will type it often.
- Two-factor on the manager account itself, ideally a passkey or a hardware key.
- Never typed on a device you do not trust. Malware that captures it captures everything at once.
- Recorded somewhere offline: on paper, where you keep documents, because there is no reset. That is the point of it, and it is also how people lose everything.
A manager also delivers a benefit people overlook: autofill only offers a credential on the domain it was saved for. On a convincing lookalike, it silently declines, which is a phishing warning arriving before you make the mistake rather than after.
Fixing the passwords you already have
Nobody rotates two hundred passwords in an evening, and attempting it is why people abandon the project. Work in this order:
- Email first. It resets everything else. Unique password, strongest available second factor, SMS removed as a recovery route.
- Anything holding money or a stored card. Banking, payments, marketplaces.
- Anything that can impersonate you: social accounts, your phone carrier, your domain registrar.
- Every reuse of the password you just retired. Attackers try exactly this, so it is the highest-value sweep available.
- Everything else, opportunistically. Change them as you sign in over the following months, and let the manager tell you which are duplicated or known-breached.
Security questions are passwords wearing a hat
Your mother's maiden name, your first school and the street you grew up on are not secrets. They are in public records, on social profiles, and in the breach corpora already. Worse, they are a documented bypass: support-desk social engineering against recovery flows is how a great many well-defended accounts are actually lost.
Treat every security answer as another password. Generate a random string, store it in the manager against that question, and never answer truthfully. There is no rule requiring the answer to be true, only that you can reproduce it.
Check whether a password is already in a breach corpus, safely. The MyRecon password tool hashes what you type inside your own browser and sends only the first five characters of that hash to the lookup service, which returns every match beginning with that prefix. The comparison happens locally. The password never leaves your device, and nothing about the check is stored, exported or kept in history.
Where this is going
Passkeys remove the shared secret entirely: the service stores a public key that is useless to whoever steals it, and the credential only works on the real domain. Where a service offers one, it ends both the reuse problem and the phishing problem for that account at a stroke, covered in the two-factor guide.
Passwords will outlast the announcements, though. Recovery flows, older services, work systems and everything embedded will need them for years, and every one of those is a place reuse can still cost you an account. A manager and unique passwords remain the practical answer, not a transitional one.