Password rules have produced a generation of short, complicated, reused credentials. The usual advice to add a symbol, a digit, and a capital letter to an eight-character word does little to make a password hard to guess. Length and randomness do. This article explains why long passphrases are the better default, how to make one properly, and how to manage the many secrets a mail account needs.
Why length beats complexity
Guessing attacks scale with the size of the space a password was drawn from. A password chosen by a person is not random. Attackers model human choices first: common words, names, years, keyboard patterns, and the substitutions everyone uses, such as p@ssw0rd. Adding a digit to a word adds very little to the real search space, because attackers try those positions as a cheap extension of the list.
A random passphrase of words is different. If you pick words uniformly at random from a list of 7,776 words, as in the Diceware method, each word contributes log2(7776), about 12.9 bits. Six words give about 77 bits, and seven give about 90 bits. Those figures assume the words were chosen randomly, for example with dice. A sentence you wrote yourself has unknown entropy, and it is usually much lower.
NIST's digital identity guidelines (SP 800-63B) reflect the same reasoning. They recommend allowing long passphrases, checking candidate passwords against lists of known breached passwords, and not forcing composition rules or periodic changes that people answer with predictable edits.
How to make one
- Use a dice-based word list, such as the EFF long wordlist, which has 7,776 words chosen to be distinct from one another and easy to type.
- Roll five dice for each word. Five dice give 7,776 outcomes, one for each word on the list.
- Use at least six words for a master passphrase. Seven is better if you can type it reliably.
- Write the words down once, on paper, and keep that paper somewhere safe. Destroy it once you have memorised the passphrase.
Do not reuse a passphrase anywhere else. Do not keep it on a note stuck to your monitor, or in an unencrypted notes app on your phone.
What needs memorising, and what does not
You should need to remember very few secrets. Most credentials should be random and stored by a password manager. The distinction matters:
- Memorised: the master passphrase for your password manager, and the disk encryption passphrase for your computer. If you log in to webmail by hand, your mail password too.
- Generated and stored: every other site password, and the app passwords used by mail clients.
- Hardware or second factor: FIDO2 keys and TOTP secrets, as covered in hardware keys vs TOTP.
Managing app passwords
A mail client cannot practically type a memorised passphrase every time it syncs, so ITProMail gives clients app passwords. Create one per device or per client. That way you can revoke a single one without locking yourself out everywhere. Account > Security lists them, and the limit is 20 per account. Your password manager should hold each one, labelled with the device it belongs to.
When a laptop is lost, revoke its app password. When you replace a phone, create a new app password for it and remove the old one. This is the same principle as the passphrase itself: a credential's exposure should be limited to the thing it was used for.
Password managers
A password manager is what makes long random secrets practical. Choose one that encrypts the vault locally with a key derived from your master passphrase, and that works on every device you use. Turn on sync deliberately, and understand where the encrypted vault is stored. Enable the manager's own second factor on the master account if it offers one.
Most password managers can generate passwords of any length from a chosen character set. Use the generator for site passwords, and set them to at least 20 characters where the site accepts them.
Common objections
Passphrases are longer to type. That is true, but a passphrase you type a few times a day is cheap compared with a password you reuse everywhere. Some sites still cap the length or reject spaces. When that happens, use a generated password from your manager rather than weakening the rule for your master passphrase.