I have seen web sites that check for various rules and I don't believe they are useful (except for a minimum length check as already provided in HexEdit). I will explain this and how to create good passwords. If you haven't the time to read the whole post, at least check out the summary at the end.
Password Validation Rules
First, a good password is not just one that is hard to break; it is important that it is easy to remember and type. Second, whatever rules the password checker imposes affects the passwords that are chosen, which can itself create an avenue of attack. Third, most of the time these rules don't ensure good passwords anyway.
I used to use a system for creating passwords and it was always really annoying when I tried a very good password but the web site prohibited it because of some rule, like it does not contain an uppercase letter or a digit.
Good passwords can fail these tests. Moreover bad passwords can pass them. You may have heard the story of one O'Reilly who worked in a high security (DOD) environment and for many years just used these passwords: "O'Reilly1", "O'Reilly2", ... These passed all the rules (mixed case, punctuation, digits, etc) but were very definitely not good passwords.
The best approach is, as always, education. The password creator should be aware of how passwords can be broken and what are good and bad password practices.
What Are Good Passwords?
There are several things to consider. First and foremost the password must be hard to crack. By far the best way to ensure this is to make sure the password is long enough. I personally use passwords of at least 30 characters. This may seem like too much typing, but it is often easier to type several words than to type a short jumble of random characters.
You probably know the commonly cited guidelines for passwords: that they should not be a word or name (in any language), involve your personal details such as car registration number, dog's name, SSN, etc.
What you are not told is that passwords should be easy to remember. Passwords that are not easy to remember get written down and left in convenient places.
Another good practice is to avoid typing your password while anyone is watching, especially if they are holding a camera (or phone). If you suspect that someone saw you type it and was trying to memorize it then you should change it immediately.
Difficult Passwords
I am currently doing some work contracting for a large company. They have a lab of dozens of test systems and someone keeps creating passwords for these systems using an English word then mixing things up by making some letters uppercase and using Leet codes (eg E => 3, I => !, etc). Here is an example:
PaTh3t!c
There are so many things wrong with this approach. When I am given such a password it can often take me many times to type it in correctly even when reading it. I have seen other people just give up thinking they have been given the wrong characters.
Not only is it hard to type but it is also hard to remember. After a while you remember how to physically type the password but forget the actual characters. This can be a problem if you need to write the password down for another person (and you have to write these types of passwords down to have any chance of getting them right).
That's the other problem with this sort of password - it's so hard to remember that people have to write it down. I am always finding little bits of paper with passwords written on them. That's not good security at all.
I was a UNIX system administrator for many years and the one thing I learnt about passwords is that the worst approach is to try to force people to use good ones.
One policy that most operating systems provide is to force users to change their password regularly. I really don't see the point in changing passwords more often than every year or so, as long as the password is a good one and you do not suspect that it has been compromised (in which case you should change it straight away).
Forcing people to think of a new password every few months, or less, means they will not try to think of a very good one. Many Windows servers (ie, domain controllers) force monthly changes - I suspect this is some sort of default that someone at Microsoft thought was a good idea. In this situation people invariably use the same password with slight variations. An informal survey I conducted in an office with this policy showed that 100% of people just used the same password but added an incrementing number to the end of it. Using this strategy some had reached large numbers (ie well over one hundred) meaning they effectively had been using the same password for more than a decade.
What I Do
I have used the same method of creating passwords since I was a UNIX system administrator and became aware of their importance (and how poor most people's passwords are). I take a line from a song. For example:
Money, so they say, is the root of all evil today
Of course, now that this information is public it makes it easier for you to crack my passwords! Even so it would take an enormous amount of time to try to crack my passwords by taking different consecutive groups of words from books and songs, even if you knew what books and songs I like.
For even more security, I also try to add some changes such as replacing "to" or "too" with 2, etc. For example:
$, so they say, = the root of all evil 2day
An added benefit is that the password is more likely to pass the password checking rules that require digits, punctuation characters, etc.
Summary
Here are the main points:
- don't use passwords of one (or even a few) words in any language
- don't use passwords related to public knowledge about yourself
- use long passwords, if possible
- don't use passwords that are hard to remember
- don't force passwords to be changed too often (eg more than every 3 months)
- don't write passwords down where they can be seen by unauthorized persons
- don't type your password where visible to a person, camera or phone
- change your password immediately if you think it may have been compromised
