Secure Passwords Guide
Your password is the first line of defense, but many people still rely on predictable patterns or reusing the same password. In an era where data breaches are constant, upgrading your security habits is no longer optional, it's essential. After reading the information below, you can change your password by following the steps on the Changing Your Password page.
Password Guidelines
-
- Length Over Complexity: A long passphrase is harder to crack than a short, complex string. Aim for at least 15 characters.
- Uniqueness is Non-Negotiable: Never reuse passwords. If one site suffers a data breach, attackers will try that same password on your email, bank, and more.
- Avoid Personal Info: Steer clear of birthdays, pet names, or addresses that can be guessed via social engineering, public records, or your own social media footprint.
- Avoid “Keyboard Patterns” and Common Substitutions: Attackers’ cracking tools are smart enough to handle common tricks.
- Weak Keyboard Patterns: P@ssw0rd, Qwerty123, 12345678
- Weak Time-Based Passwords: Summer2024, Winter2026
- Don't Share Passwords: Even if you trust the person, sending a password via SMS or email leaves a permanent record. Your password should be for you alone.
Creation Techniques
Although long random passwords are good, you can make it even stronger by introducing unpredictable randomness without sacrificing memorability. Here’s some methods on how to do it:
-
- Pick 4 random words from different categories and separate them with a symbol or number or both.
- To add genuine unpredictability, you can even roll physical dice to select words from a list or dictionary.
- To eliminate predictability and the memory burden entirely, use a password manager to create your passphrase.
This approach creates high entropy that resists dictionary attacks, while the resulting visual imagery helps your brain recall it effortlessly.
Generally speaking, however, remembering dozens of unique, random passwords across accounts is humanly impractical. As such, it is recommended that you use a password manager to generate, store, and autofill complex passwords. This way, you only need to remember one master password but make sure to choose a trusted solution that supports end-to-end encryption, like Bitwarden or Proton Pass.
Password Manager FAQs
Isn't putting all my passwords in one place risky?
It seems counterintuitive, but a password manager is actually safer than your current method. Without one, you're likely reusing passwords or choosing weak ones, both of which are far more dangerous. A password manager encrypts your data, meaning even if the service is breached, your passwords remain unreadable without your master password.
What if the password manager company gets hacked?
Reputable password managers use zero-knowledge architecture, meaning your data is encrypted on your device before it ever reaches their servers. They never store your master password or can decrypt your vault. Even in a breach, attackers would only get encrypted data they cannot use.
Can the password manager company see my passwords?
No, not if you choose a zero-knowledge provider. With end-to-end encryption, only you hold the decryption key (derived from your master password). The service provider cannot access your stored passwords, even if subpoenaed. This is why choosing a trusted provider matters.
What if I forget my master password?
This is the one password you cannot recover. Most password managers do not store it, so there's no "forgot password" reset. This is a security feature, not a bug. To prevent lockout:
-
- Choose a memorable but strong passphrase.
- Store a written copy (whether full or partial) in a secure physical location.
- Some services offer emergency access or recovery contacts. Set these up in advance.
Is it safe to let the password manager autofill my credentials?
Yes, when used correctly. Modern password managers only autofill on matching domains, reducing phishing risks. However, be cautious on shared or public computers. For maximum security, you can disable autofill and manually copy-paste credentials when needed.
Are free password managers safe to use?
Some are, but read the fine print. Free tiers often limit features (number of passwords, device sync, or advanced security options). For critical accounts, consider a paid plan from a reputable provider. Look for independent security audits, transparency reports, and a track record of privacy advocacy.
What if I want to switch password managers later?
Most services allow you to export your vault in standard formats (CSV, JSON). Before switching, ensure you can import the data into the new manager and test that everything works. Keep your old vault backed up until you're confident in the transition.
What password managers do you recommend?
While selecting a password manager depends heavily on personal preferences and available resources, Clark College community members have historically found success with Bitwarden and Proton Pass.
Checking for Leaked Passwords
Data breaches happen constantly. Hackers steal databases containing millions of usernames and passwords, which are then sold on the dark web. But how do you know if your data is among them?
Have I Been Pwned (HIBP) is a free, widely trusted service that aggregates data from known breaches and allows you to search your email address to see if it has appeared in any compromised datasets.
How to Use Have I Been Pwned
-
- Visit havibeenpwned.com
- Enter your email address
- Click the "Check” button
- (Optional) Sign up for notifications by clicking the "Notify Me" button and following the instructions. You'll receive an alert if your email appears in future breaches.
What the Results Mean
-
- Good news – no pwnage found: Your email hasn’t been found in the breaches currently indexed by Have I Been Pwned.
- Oh no – pwned: Your email was found in one or more breaches. The site will list exactly which breaches
and what data was exposed (passwords, names, physical addressed).
Note: If you receive this result on a Clark College email, it does not mean that Clark College suffered a data breach, just your individual email address from a website you signed up for with your Clark College email.
- Good news – no pwnage found: Your email hasn’t been found in the breaches currently indexed by Have I Been Pwned.
How to React to a Leak
If your email appears in a breach:
-
- Change your password immediately for that specific service.
- Check for reuse: If you used that same password elsewhere, change it on all those other sites too.
To reset your Clark College password, follow the steps on the Changing Your Password
page.
- Enable MFA: Add an extra layer of security to prevent unauthorized access even if the password is stolen again. To enable MFA on your Clark College account or to learn more about MFA, visit the Multi-Factor Authentication Guide page.
- Change your password immediately for that specific service.
Contact Us
General Inquiries: For non-urgent questions, email infosec@clark.edu.
Report an Incident: To report an information security incident, please visit the Report an Incident page.
Additional Resources
Multi-Factor Authentication Guide