At least 8 characters, 1x capital letter & 1x special character

Or what was that again? Today is the ‘change-your-password-day’ - which may seem superfluous to some, but has its justification: because too many users still use passwords like ‘1234567’ or ‘password’. Unfortunately, personal data and accounts are not adequately protected in this way. You can find out what a secure password should look like in this blog post.

What is the point of passwords at all?

Whether you're unlocking your smartphone, using your work PC, shopping online or using social networks: every login requires a password. For many of us, this is not only tedious, but also time-consuming - especially if we don't have the recently generated code to hand.

The most common method is therefore: simple, very short passwords and one for a large number of accounts. However, this is where the great danger lies: popular combinations such as ‘123456’ or ‘password’ do not bring the desired success. The purpose of passwords is to protect our sensitive data and prevent unauthorised persons from accessing it. The ‘Change Your Password Day’ on 1 February is intended to sensitise us to the issue and encourage us to take action. However, ambition quickly wanes when you consider how many accounts we need a new password for.

Multiple accounts, one secure access code - a good move?

Even if it is a tiresome affair: it makes sense to assign a separate password to each account.This is because the security risk that would otherwise exist is enormous. Cyber criminals would then only need to crack a single password to take over several accounts at once.

This would give them access to digitally stored data, documents and images, to shopping accounts that may offer purchase on account and, in the worst case, to our ‘digital wallets’.This is unimaginable damage that will burden you with costs and effort long after the attack.On the other hand, regularly updating your passwords suddenly seems very attractive.But:

How are you supposed to memorise the enormous number of passwords?

Unfortunately, as soon as you write down passwords or store them in digital form, it is possible for unauthorised persons to gain access to them - whether through hacker attacks or a break-in. The best option is therefore to memorise your passwords. Unfortunately, this is often not so easy - especially if you have a large number of online accounts. One trick to make it easier to memorise passwords is to create so-called ‘passphrases’ instead of letter and number codes.

This is a long string of characters consisting of several words. The more nonsensical, the better - and perhaps also the more memorable for you. Song lyrics, poems or advertising slogans can form a basis here - but they urgently need to be heavily modified so as not to give cyber criminals a ‘breeding ground’. We will give you an example:

• Well-known phrase: Einstein's theory of relativity is: E=mc²
• Modified passphrase: My theory of relativity is: when it's dark it's better than sitting!!!

As silly as this may seem, the advantage is that this string of words (especially in combination with numbers and special characters) is extremely difficult to guess - but for most of us it is much more memorable than, for example, ‘1t673ng74j29d!44’.

An alternative for memorising passwords can also be a so-called ‘password vault’. Here you only need a master password that you have to memorise. The tool then generates a secure password for each initial login to an account and saves it in your password vault. But here too, as secure as the programmes may be, there is unfortunately no 100% guarantee that they cannot be cracked. However, both variants are a better alternative to the - unfortunately still - most common variants that many users use as passwords.

The worst passwords of 2021

According to an article by nordpass, the top 20 most common passwords in all countries are as follows (here is the link to the source)

Rank 1      123456

Rank 2      123456789

Rank 3      12345

Rank 4      qwerty

Rank 5      password

Rank 6      12345678

Rank 7      111111

Rank 8      123123

Rank 9      1234567890

Rank 10    1234567

Rank 11    qwerty123

Rank 12    000000

Rank 13    1q2w3e

Rank 14    aa12345678

Rank 15    abc123

Rank 16    password1

Rank 17    1234

Rank 18    qwertyuiop

Rank 19    123321

Rank 20    password123

According to their findings, only rank 14 takes more than a second - 2 to be precise - for hackers to figure out the password. All others are cracked in less than 1 second. But how do you generate a password that is as secure as possible?

Our recommendations for a secure password

Here is a list of our recommendations on how to create the most secure password possible for your online access:

Recommendations and important precautions on the subject of data protection

• Number of characters, numbers and special characters: Your password should be at least 8 characters long (12 or even 16 would be better) - also include capital letters, numbers and special characters.Do not use logical sequences (e.g. 12345678) or personal data such as your date of birth or wedding anniversary.Words that appear in a dictionary should also be avoided - because there are certain hacker tricks called ‘dictionary attacks’ that can combine meaningful words and sequences of numbers in a matter of seconds and crack them.
• Store in memory: To prevent unauthorised persons from gaining access to our passwords, we should ideally only have them in our heads. Passphrases can help with this. If you do keep them - e.g. to make them available to relatives in your estate - do not store passwords on electronic devices (e.g. PC or smartphone), but keep them in a safe place (e.g. safe, safe deposit box).
• Use so-called passphrases:Not only to make it easier to memorise access codes, but also because it is much more difficult to crack a string of words than a single password.Nonsense makes sense: in other words, the more illogical the word strings are, the less likely it is that they can be cracked.If you use an advertising slogan, a song lyric or a proverb as a basis, modify it considerably and add special characters and number combinations.
• A password vault as an alternative: Use so-called ‘vault programmes’ to store your passwords securely.These generate a secure password the first time you log in.You only need to remember a master password in order to be able to log in again to the pages you have already registered. But be careful: even this technique is not 100% secure.
• Create a separate password for each account: Only use your secure passwords for one account at a time.Otherwise, you open the doors to all the shops, platforms, data storage and ‘online wallets’ to cyber criminals - because they only need to crack one password for all of these.
• Use two-factor authentication for platforms that require protection:This technology is particularly well known in online banking: in addition to the access code, every activity on the portal requires further authentication.For example, entering a TAN if you want to make a bank transfer.
• Be careful with online services that check passwords: Would you like to know whether the password you have chosen is secure? It's better to avoid online services where you can have the security of your access code checked.In the worst-case scenario, this could be a scam that is trying to steal your passwords.Your IP address can be used to trace which accounts you have visited. Data thieves then only have to enter the passwords there.
• Use biometric tools:Smartphones or tablets in particular offer options for using facial recognition or fingerprints instead of (or in addition to) a password.This means you don't have to remember anything and you can only lose your face if you don't protect your accounts adequately.
• Use powerful, secure hardware from reputable manufacturers that is up to date with the latest technology and carry out regular updates.We have inexpensive, used business devices such as notebooks or PCs for you here:

In addition to a secure access code, there are other ways to protect your data and online accounts. For example, by using a firewall, a virus scanner or a backup. You can also read our recommendations and information in our other blog posts:

Data protection blog post 

Blog post: ‘IT security on holiday: because hackers don't go on holiday’

Blog post: ‘Workplace 2.0: Data disaster in the home office?’