Skip to main content


Many think that passwords with random characters are more secure.

Truth is: "four random common words" make the best password - secure and easy to remembers! 🔒

What is your password strategy?

Here are more facts about passwords and security: 👇
https://tutanota.com/blog/posts/how-create-strong-password

in reply to Tuta

Seems like this technique could be easily bruteforced by a dictionary attack, despite being a longer number of characters.

Personally (I'm no expert) I use a password manager. Most of my passwords are 128 characters (longer than four average words) that also use special characters, numbers, upper and lower case characters. Using a physical key such as a #Yubikey seems a better way, too.

I love #XKCD, but the advice in this strip seems kinda out of date.

in reply to Tuta

me? i have a one base for password, few suffixes and i use an interpunction inside.
easy to remember and practically i can have different passwords for different websites ;)
in reply to Tuta

I like the ones that try to be secure by making sure I use exactly 8 characters, with at least one number and one capital and one symbol. Great. Now I can't remember it and it's super easy to brute force. Luckily those are few and far between but I still find that not being able to just use four words in pretty much any password field.
in reply to Tuta

1. One password per account.

2. MasterPassword as Password Manager on Android.

It will calculate your password based on "site" and "master pass". You can configure how secure it needs to be, from ...

SI@bGZyFl3gMIV3jhw0]
... over ...
RobiPiwoFipy6%
... down to ... 6837

(Those are no actual PWs of mine)

in reply to Tuta

Tails also recommends passphrase like that:

https://tails.net/doc/persistent_storage/create/index.en.html

A seed phrase (secret key) of a cryptocurrency is also often like that (but much longer): e.g.

weather space finger float jeans tool hold divide...