Best way to make an uncrackable passphrase, using What3words

flaneurs_lobster

advises the most secure password is minimum 16-characters in length "three random words".

Think they have rather simplified their advice, it should have had "…that can be remembered by the average person".

My password manager will provide a 120 character 'random' string of characters that if used as a password would, I suggest, be rather more secure than the NCSC's suggestion. But not really memorable (in the literal sense).

But, in the real world, where at least one building society I sign into has a maximum password length of 12 characters (alphanumerics only, not case sensitive) and another needs only my DoB and a 4 digit PIN…..

Grumpy_chap

https://forums.moneysavingexpert.com/discussion/comment/82180622#Comment_82180622

Well, the full advice from the Client was not to memorise or write down the password but to use an online password manager with Microsoft Authenticator MFA.

Now, I have never used an online password manager but it seems to me that such a service can only keep any password as secure as the access control to the online password manager which, presumably, is a password of some kind.

sausage_time

My password manager is set to store the password file locally, never on-line. I do use an authenticator app for those sites that support it (generally in addition to a password).

flaneurs_lobster

Now, I have never used an online password manager but it seems to me that such a service can only keep any password as secure as the access control to the online password manager which, presumably, is a password of some kind.

Well my password manager does have the facility to do away with the Master Password altogether and instead use passkeys but, TBH, I lack the cojones to actually take that step.

Have done it with my Microsoft and main email services though. Not too many sites have the facility.