The password strength testing tool provided by Microsoft, called the Microsoft Password Checker, has four levels: Weak, Medium, Strong, and BEST. You can test whether your password is strong enough.
Do you use strong passwords?
A strong password should appear to be a random string of characters to an attacker. It should be 14 characters or longer (with a minimum length of eight characters). It should include a combination of uppercase and lowercase letters, numbers, and symbols.
Microsoft provides three recommendations for creating strong passwords: 1) Use random strings; 2) The password length should be at least eight characters, preferably over 14 characters; 3) It should consist of a mix of uppercase and lowercase letters, numbers, and symbols.
However, machines are still machines, ultimately mechanically treating everything as either Y or N, as shown in the following example:
I created a password using all 26 letters of the alphabet. Although the keyboard arrangement followed a certain order, it shouldn't have been classified as "Weak," right? I then increased the number of letters to 52, repeating the entire keyboard sequence twice, but it was still marked as "Weak." This was quite surprising.
As a result, I figured out Microsoft's definition rules for password security (dividing password characters into four categories: lowercase letters, uppercase letters, numbers, and symbols):
1. Any combination with fewer than 8 characters is "Weak."
2. Any combination consisting of only one type of character, regardless of the number of characters, is "Weak."
3. Any combination consisting of two types of characters, regardless of the number of characters, is "Medium."
4. A combination of three or four types of characters with less than 14 characters is "Strong."
5. A combination of three or four types of characters with more than 14 characters is "BEST."
Although this rule may seem rigid, for most users, using a "BEST"-level password with more than 14 characters should be sufficient to ensure security. Don't find passwords too troublesome; if you want to make it simple, others will also find it easy to crack.
ZFreet’s suggestions for setting secure yet memorable passwords are:
1. Set a universal password for registering most accounts that aren't very important. Currently, about 90% of my accounts use the same universal password, and if they're compromised, it's not a big deal.
2. Set one or more private password strings and a private password format, and use this format to set different passwords for each important account. A recommended format is "domain name of the account + one or more password strings."
3. Most importantly, don't tell anyone your password strings or password format, because even the longest character strings won't help if someone knows them.