How do you generate a strong password that you can actually use?
The UK National Cyber Security Centre (NCSC) offers two approaches depending on your situation:
Three random words, for passwords you need to remember and type. Pick three unrelated words at random (not a phrase from a song or film). Something like "pepper-cloud-seven" is far harder to attack than "P@ssw0rd123!" despite feeling simpler. Length beats complexity every time.
Long random passwords stored in a password manager, for everything else. A 20-character random string from a password generator, stored in a manager like Bitwarden or 1Password, is the strongest practical option for online accounts.
NCSC guidance also says: do not force regular password changes unless there is evidence of compromise. Mandatory rotation encourages weak, predictable patterns ("January2024!" becoming "February2024!").
For critical accounts, admin panels, email, banking, aim for 20 characters or more, fully random.
What makes a password genuinely hard to crack?
Attackers do not guess passwords one letter at a time. They use:
- Dictionary attacks: lists of common words, names, and leaked passwords (the "rockyou" list alone contains 14 million entries)
- Credential stuffing: taking username-password pairs from one breach and trying them on other sites
- Brute force: trying every combination, which is only practical against short passwords
The NCSC's partnership with Have I Been Pwned (HIBP), the breach-monitoring service created by Troy Hunt, means the NCSC actively checks whether passwords appear in known breach databases and warns against reusing them.
A password that is 16 characters, fully random, and unique per account defeats all three attack types. Complexity rules (requiring a symbol, a number, an uppercase letter) matter far less than length and randomness.
How do you check if your email appeared in a data breach?
If a service you use is breached, your email and hashed (or, in badly run services, plain-text) password may be sold on criminal forums. Checking whether your email appears in known breaches tells you which old passwords to change.
Have I Been Pwned lets you search by email address or by phone number. The NCSC integrated HIBP data into the UK government's Cyber Aware campaign. Entering your email shows which breaches it appeared in and what data was exposed (passwords, phone numbers, addresses).
If your email appears in a breach, change the password for that service immediately, and check whether you reused that password elsewhere. Enable two-factor authentication on any account where it is available.
What is password hashing and how does it protect stored credentials?
When a site stores your password correctly, it never saves the plain text. It runs the password through a hash function, a one-way mathematical operation that produces a fixed-length output called a hash or digest.
When you log in, the site hashes what you typed and compares it to the stored hash. If they match, you are authenticated without the server ever knowing your actual password.
Key properties of cryptographic hashing:
- One-way: You cannot reverse a hash to get the original input
- Deterministic: The same input always produces the same hash
- Collision-resistant: Different inputs should not produce the same hash
For storing passwords, slow hashing algorithms are better: bcrypt, scrypt, and Argon2 are designed to be computationally expensive, making brute-force attacks impractical even if the database is stolen. SHA-256 and SHA-512 are fast (good for file integrity checking) but too fast for password storage, a modern GPU can test billions of SHA-256 hashes per second.
Under UK GDPR, Article 32 requires "appropriate technical measures" for stored personal data. Using proper password hashing (bcrypt or Argon2) is a baseline expectation. Using MD5 or plain text storage has resulted in ICO enforcement action.
Is Base64 a form of encryption or protection?
No. Base64 is an encoding scheme, not encryption. It converts binary data into a text string using 64 printable ASCII characters. The result looks scrambled but any tool, including any browser developer console, can reverse it instantly with no key required.
Base64 is used to transport binary data through systems that only handle text: embedding images in HTML emails, encoding JWT tokens, representing binary API payloads as text.
Never use Base64 to hide sensitive data. Encoding is not protection. If you see a password or API key stored as Base64, it is effectively stored in plain text. Proper protection requires actual encryption (AES-256 or similar).
The Base64 Encoder/Decoder on this site converts text and files to and from Base64 in the browser. Useful for inspecting JWT tokens, working with data URIs, or understanding what an encoded value actually contains.
What is two-factor authentication and why does it matter?
Two-factor authentication (2FA) adds a second check beyond your password. Even if an attacker has your correct password (through a breach, phishing, or guessing), they cannot log in without the second factor.
The three common 2FA types, in order of strength:
- Authenticator app (Google Authenticator, Authy, Microsoft Authenticator), generates a 6-digit code that changes every 30 seconds. Not phishable through most standard attacks.
- Hardware security key (YubiKey, Passkey), a physical device you plug in or tap. The strongest option; the key is bound to the specific site so phishing attacks cannot intercept the code.
- SMS code, a code sent by text message. Better than nothing, but vulnerable to SIM-swapping attacks where an attacker convinces a mobile provider to transfer your number.
The NCSC recommends enabling 2FA on email accounts first (email is the recovery mechanism for almost every other account), then banking, then social media.
If you are a developer, implement TOTP (Time-based One-Time Password, RFC 6238) in your applications. Library support exists in every major language and framework.
Practical checklist
- Passwords: 16+ characters, fully random, unique per account
- Storage: password manager (Bitwarden is free and open source; 1Password and Dashlane are well-regarded paid options)
- Breach check: search your email on haveibeenpwned.com
- Developer responsibility: hash passwords with bcrypt or Argon2, never MD5 or plain text
- 2FA: enable on email, banking, and any account with personal or payment data
- Base64 is not security, use AES-256 for anything you actually need to protect