Password Strength Tester

October is Cyber Security Awareness Month, and passwords are still the front door to most accounts. This page explains what makes a password strong, based on guidance from the Canadian Centre for Cyber Security, and how organizations can hold every account to the same standard. It comes from Optrics Engineering, ManageEngine's Canadian partner in Edmonton, Alberta.

What makes a password strong?

Length matters most. The Canadian Centre for Cyber Security recommends passwords of at least 12 characters, or better still, passphrases of at least four words and 15 characters. A strong password is also used for only one account, isn't built from a common word or pattern, and hasn't appeared in a data breach.

Is a passphrase better than a password?

Usually, yes. A passphrase of four or more unrelated words, such as four things you can see from your desk, is longer than a typical password and easier to remember, which is why the Canadian Centre for Cyber Security recommends passphrases over short, complex passwords.

When a site won't accept 15 characters, use the most complex password it allows, with upper and lower case letters, numbers and symbols. A memorable way to build one is to take the first letter of each word in a sentence you know well and keep its numbers and punctuation.

What password mistakes should I avoid?

The most common mistakes are choosing a well-known password or word, using the same password on several accounts, and keeping a password that has appeared in a data breach. Swaps such as p@ssw0rd for password don't help much, because password-cracking tools try those substitutions early.

• Don't use common passwords or words such as "password", "letmein" or "1234", even with letters swapped for symbols.
• Change the default password that comes with new hardware or software before you use it.
• Use a different password for each account, especially banking, email and your Canada Revenue Agency account.
• Don't keep a password that has shown up in a known data breach.
• Don't share a password by email, text or phone, and type it only on the sign-in page it belongs to.

Does multi-factor authentication make passwords less important?

Multi-factor authentication (MFA) asks for a second proof of identity, such as a code from an app or a fingerprint, so a stolen password alone isn't enough to sign in. The Canadian Centre for Cyber Security notes that with MFA in place a shorter password, even 6 to 8 characters, can be acceptable, but a strong, unique password combined with MFA is still the safer choice.

How can an organization enforce strong passwords?

Organizations enforce strong passwords with a policy that every account has to meet, checked at the moment a password is set, combined with MFA at sign-in. ManageEngine ADSelfService Plus adds a Password Policy Enforcer to Active Directory that can block dictionary words, keyboard patterns, repeated characters and passwords found in known breaches, and tells users which rule a new password fails.

Can Active Directory block breached or common passwords on its own?

Not on its own. Active Directory's built-in password policy covers length, complexity, age and history, but it doesn't check new passwords against breach lists or block predictable patterns. ADSelfService Plus checks each new or reset password against the Have I Been Pwned breach database and against built-in and custom word lists before the password is saved to Active Directory.

Where does ADSelfService Plus enforce password rules?

ADSelfService Plus applies its password rules wherever users set a password: in its self-service portal and mobile app with the Standard edition, and also at the Windows Ctrl+Alt+Del change-password screen and in Active Directory Users and Computers with the Professional edition. Rules can differ by OU or group, so administrator accounts can be held to a stricter policy than everyone else.

A Free edition covers up to 50 domain users, and Optrics quotes the paid editions in Canadian dollars.

How should shared and administrator passwords be managed?

Shared accounts and administrator credentials are best kept in a password vault rather than in spreadsheets or people's memory. ManageEngine Password Manager Pro stores privileged passwords in an AES-256 encrypted vault, resets them automatically on the systems they protect, and records every access, so you can see who used which password and when.

See the Password Manager Pro page for editions and licensing in Canada.

Is this password strength tester safe to use?

Yes. The tester runs entirely in your browser: what you type isn't sent to Optrics or anyone else, isn't saved, and is cleared from the box when you reveal your score. Even so, test a made-up example, because typing real passwords only on the sign-in page they belong to is a good habit to keep.

What is Cyber Security Awareness Month?

Cyber Security Awareness Month is an international campaign held every October to encourage better security habits online. In Canada it is led by Get Cyber Safe, the Government of Canada's public awareness campaign, on behalf of the Communications Security Establishment. Optrics features this password strength tester on its home page each October.