Password requirements
- At least 12 characters
- Uppercase and lowercase letters
- Digits and special characters
- Do not use dictionary words
- A unique password for every service
Why short passwords break in minutes
A password's resistance to brute force is measured in bits of entropy: the number of bits equals the password length times log2 of the character set size. An 8-character password from an alphabet of 26 lowercase letters gives about 37 bits — a modern consumer graphics card works through that space in under a day in an offline attack on a stolen hash.
| Length and alphabet | Approximate entropy | Offline cracking time |
|---|---|---|
| 8 characters, lowercase letters | ~37 bits | Hours |
| 8 characters, letters+digits+symbols | ~52 bits | Weeks |
| 12 characters, letters+digits+symbols | ~78 bits | Practically uncrackable |
| A passphrase of 5 random words | ~65 bits and up | Practically uncrackable |
The time estimate is approximate and depends on the attacker's hardware and the hashing algorithm, but the order of magnitude is right: every extra character multiplies the search space, it does not just add to it.
Anatomy of a common attack: credential stuffing
Most account takeovers do not happen through a password guessed on your site — they happen because a password leaked in a breach on another service gets reused. The attacker takes an email:password database from a public breach and tries the same pairs on dozens of other sites automatically.
Why uniqueness matters more than length
A 20-character password will not save you if it is also used on three other sites and one of them has already been breached. A password manager solves this problem technically: it makes creating and storing a unique password for every service no harder than remembering one master password.
Passphrases: the Diceware method
If a password has to be memorised by hand (for example, the master password for a manager), it is more reliable not to invent letter-to-digit substitutions but to assemble a phrase from several random words using the Diceware method: you roll dice, look up the word matching the numbers rolled in a fixed list, repeat 5-7 times and join the words. Randomness comes from the dice, not from your imagination — humans are poor at generating randomness mentally and predictably pick words tied to names, dates or keyboard patterns.
Recommended password managers
- Bitwarden — free, open source, reliable
- 1Password — convenient, good for team use
- KeePassXC — local storage, maximum privacy
When a password manager is not a fit
- A shared computer with no personal profile — the next user will see passwords saved in the manager's browser extension.
- A device with no screen lock — the master password protects the vault, but it does not replace a PIN or biometrics on the device itself.
- Emergency access for a third party (for example, a relative in case you become unavailable) — both Bitwarden and 1Password have a dedicated emergency access feature for this, rather than handing over the master password directly.
Two-factor authentication
Enable 2FA in your ZevsHost client area. Use Google Authenticator or Authy to generate codes — they work on the TOTP standard (a one-time code based on time and a secret key) and do not depend on cellular service, unlike SMS codes.
Why SMS codes are weaker than an authenticator app
SMS can be intercepted through a SIM swap at the carrier or through vulnerabilities in the SS7 protocol. A TOTP code in an app is generated locally on the device and never travels over the network, so it cannot be intercepted in transit — only the secret key can be stolen, and only during initial setup.
Hardware security keys (FIDO2/WebAuthn)
The most break-resistant second factor is a physical security key supporting the FIDO2/WebAuthn standard. Unlike a TOTP code, which a person can type into a fake page, the key is cryptographically bound to a specific domain: even if the user lands on a phishing site identical to the original, the key will refuse to confirm the login because the domain in the request does not match the one the key was registered for. This protects specifically against phishing, not just against guessing a code.
Verifying the protection is actually on
- Log out and log back in — the system must ask for a one-time code, not just a password.
- Save the 2FA backup recovery codes in your password manager as a separate entry — without them, losing your phone means losing access to the account.
- Check your password against a breach through a service like Have I Been Pwned by hash, without sending the password in plain text.
- Make sure the master password of your password manager does not match any password you have used before on other sites.
Two-factor protection on the server itself is covered in two-factor authentication on the server, and logging in with SSH keys instead of a password is covered in SSH keys for a VDS.