The Messed Up World Of Online Security
For years, I have recommended password managers to my clients to manage their online passwords securely. I’ve also advised using passwords that are at least 18 characters long, generated randomly by built-in password generators. This practice has proven effective: even as major data breaches occurred at various companies, none of my clients experienced account misuse.
Why 18 characters? When I crunched the numbers 15 years ago, it became clear that this length would offer strong protection throughout my clients’ lifetimes. The table below illustrates just how challenging it is to crack passwords of varying lengths and complexities using today’s computing power.
| Password Length | Numerical (0-9) | Upper & Lower Case (a-z, A-Z) | Numerical + Upper & Lower Case | Numerical, Upper & Lower Case + Special Characters | Estimated Cost To Crack (USD) |
|---|---|---|---|---|---|
| 8 | 0.10 seconds | 14.85 hours | 2.53 days | 76.78 days | $55.28 |
| 10 | 10.00 seconds | 4.58 years | 26.61 years | 1898.58 years | $498,946.82 |
| 15 | 11.57 days | 1.74 billion years | 24.38 billion years | 14.69 trillion years | $3.86 trillion |
| 20 | 3170.98 years | 662.6 trillion years | 22.3 quintillion years | 113.7 sextillion years | $29.87 quintillion |
This table highlights how longer and more complex passwords are significantly harder—and costlier—to crack.
The cost to crack is based on the password length and the type of characters in the password. The table above only shows what it would cost if passwords consisted of a combination of numerical, upper and lower case letters and special characters, which would be normal best practice for choosing a password.
Despite my recommendations, clients often face restrictions due to password length and character limitations imposed by banks, government sites, and businesses. I had hoped industry standards would evolve to enforce a minimum length of 15 characters, but progress has been slow.
Additionally, mandatory use of password managers could have solved the classic problems of remembering passwords and avoiding password reuse. There are plenty of reliable and user-friendly password managers available today—there’s no excuse not to use one.
Unfortunately, as major breaches continue, companies scramble to introduce various Two Factor Authentication (2FA) methods (relying on phone, text, emails, apps, etc.). This reactive approach has created a fragmented and increasingly complex security landscape. In my mind, this is making it impossible for many people to access online services.
To add insult to injury, the newer complicated 2FA security measures, make it almost impossible to use a traditional password manager!
Looking ahead as we approach 2025, I see mounting complexity in an area that could have been much simpler. The guiding principle should have been clear from the start: “Mandatory password manager use and a minimum password length of 15 characters.” Had this been the industry standard, we might be living in a much safer and less complicated digital world today.