How to Make a Secure Password

A secure password must adhere to the following three principals:

1. Passwords must never be written down.
   • therefore they can not be completely random (person would have to write down something that was completely random)
   • they should not be stored anywhere (wallet, purse, sticky tab, on computer, etc). This includes the "Remember my password" feature of many browsers, websites, software, etc.
2. Passwords must not be predictable.
   • can not contain personal information
   • can not be a word (or made up of words) found in the dictionary
   • should appear to be random (but of course can not be completely random, because that breaks rules 1 and 3)
3. Passwords must be unforgettable.
   • You have to use it, so it has to be something you can memorize
   • The most secure place for storing a password is in you mind.

Many security constants (and other like minded people) will also say that passwords should be unique. That is, you should have a different password for each account/system/location that a password is needed. I feel that 1 secure password is better then many "not so secure" passwords, but I will address this issue later in the how-to.

Technique to Making a Secure Password

If we take all three principals together, it means that we need to make a password that is easy enough to remember (never written down, and unforgettable) but also appear to be a random string of characters (not be predictable). The best way to do this is to start out with something you can remember, then run it though a simple algorithm (process) to convert it into what appears to be a completely random string.

Step One

Start with some trivial, easy to remember word(s) or name(s). It can be a name, a place, a color, a song lyric, what ever you want. Just as long as it is something easy for you to remember.

Step Two

Create a translation algorithm, a simple rule/set of rules, to convert your step 1 string into a secure string of random gibberish.

Step Three

Throw in some "salt" - some seemingly random characters added to your step 2 string of characters to create a unique, easy to remember password. This step is usually optional, but can also be helpful in cases where you want a unique password for every account, or where you have to change your password every X number of days.

Usage

I know this seems very confusing, but once you have done it a few times, it becomes very easy. This is one reason why I regularly suggest AGAINST the "remember me" feature of many websites/browsers/etc. If you let the computer remember the password, you don't let your mind learn it. (Why is it again that we don't let students complete other students homework?!)

Algorithm Examples

The hardest part is coming up with a workable algorithm - you need to change your easy to remember string into something that appears completely random. Below are just a few examples to help you out. You can use one of these, or you can come up with your own.

Example #1

Easy to remember word(s) or name(s) - Take a line from your favorite song or your favorite poem as your starting point. You could even use different songs for different accounts. For example I might use "Money" by Pink Floyd as my financial accounts password, and "Schools Out" by Alice Cooper for school accounts, and "The Letter" by The Boxtops for my email.

Easy to remember algorithm - Now take only the first letter of each word.

And then convert a few of the letters with a "look alike" number, for example:

• 1 looks like a lowercase L
• 2 looks like a Z
• 3 looks like a backwards E
• 4 looks like an A
• 5 looks like an S
• 6 looks like a G
• 7 looks like a T
• 8 looks like an R
• 9 looks like a backwards P
• 0 looks like the letter O

add some salt -Throw in some things to make it "more" random. In this case, I would through in a dash in place of the apostrophe.

Or lets say I know this is on an account where I will be forced to change my password every thirty days. I can through in the month

Or lets say I want to use this as my "base" password for all my accounts. BUT I still want to make each account have a different password. I can use 3 letters of the account's name/website.

Usage -Now when I need to type my password, I don't have to remember some random strings, I just have to remember the line "We can't even think of a word that rhymes" and my algorithm. Since I use the same algorithm for all my passwords, it is easy to remember. Now as I type the password, I just say to myself my song lyric.

Example #2

Easy to remember word(s) or name(s) - Lets pretend that my name was Anthony Douglas Smith. So I am going to take my middle name, and the other two initals.

Easy to remember algorithm - Using the keyboard, I am going to shift the letters to left one place (I could do up/down/right or even 2 places, etc).

add some salt -Throw in some things to make it "more" random. You can use any of the ideas above, or here are some additional "salting" ideas.

One example (for the "math geeky" people) would be to throw in a number, but convert the base. Convert the "normal" number from base 10 to base 2, base 8 or base 16 for your computer nuts, or or for you math and history nuts try base 20, base 60.

Or something a bit easier, maybe Anthony was born on March 10th.

Usage -This is why I think this would be great for touch-typists. When it comes time to enter your password, just shift your hands according to your algorithm. Now you just let your "muscle-memory" type out the letters of your step 1 word(s).

Wrap-Up

I have given you two algorithm examples, both are very good at creating a random string that can be used as a password. Or, if you don't think you can use/remember my two examples, you can make up your own. The key is that when you are done, you should have a password that meet the three criteria:

1. Don't write it down/store it anywhere but inside your head
2. When you do write it out (say when you are developing your algorithm) it has to look like a completely random string of characters. (cat74coffee does not cut it)
3. It has to be something you can remember. (That is why you must practice using it - no more "remember me" settings.

 

Pennsylvania Virtual Charter School • One West Main Street, Suite 400 • Norristown, PA 19401
Phone: 610-275-8500 • Toll Free: 1-866-PAVCS-K12 • Fax: 610-275-1719 • E-Mail: info@pavcsk12.org • Sitemap