View source for Make sure you have a password

==How to choose a strong passphrase==

=== Recommended: using a sentence instead of a word ===
{{main|:en:Passphrase}}

For a long time, it has been recommended to use a complex password with lots of numbers and special characters. These passwords can be hard to remember, and they are usually very short. Instead, you might want to try using a '''passphrase'''. A passphrase consists of multiple words, and it does not need to contain special characters to be as secure as a classical "strong password".

* To generate a really secure passphrase, take any book of your choice, open it at a random position and choose a random word. This might be "correct".
* Repeat at least four times. The result might be something like "correct horse battery staple".<ref>https://xkcd.com/936/</ref> That would be a good passphrase, if it hadn't been published as an example on the internet. Use something else!

You can also think of a completely silly sentence yourself, for example "Uncle Udo fishes Marvel Spiderman" or "Tom Riddle eats computer t-shirt".

Be warned! Humans [[:en:Password strength#Human-generated passwords|have strong biases]] towards certain words. For instance, "Uncle Udo" alliterates, and is an even worse idea if you actually have an Uncle Udo and he likes to fish. "Marvel" has an obvious conceptual link to "Spiderman" (Marvel comics). "Tom Riddle" is a concealed name used by character in a popular novel series; such pop-culture references may be found in passwords quite a lot. "Eats", like "fishes", fits grammatically with its antecedent, and "computer" and "t-shirt" are things someone is likely to be able to see while making up a password.

Books also have strong biasses. Any given book will never use most of the words in a language, and rarely use most of the other words, but use some words very frequently.

Because of these biasses, neither of these methods will be anywhere near as secure as a passphrase genuinely chosen at random, using a solid [[:en:random password generator|random password generator]]. See [[:en:Passphrase|passphrase article]] and [[:en:User:Johnuniq/Security|this essay]] for more detail.

=== Alternative: classical password ===

If you really want to use a classical password instead, please keep the following things in mind:

* Longer passwords are better: a minimum of eight [[wikt:alphanumeric|alphanumeric]] characters is usually suggested, with mixed cases in the alphabetic characters. 
* Do not use birth dates, family names, phone/social security/passport/ID numbers, or any other information tied personally to you or someone you know.
* Do not use words that may appear in any dictionary (e.g., no foreign words either).
* Use nonsensical strings of characters (e.g., not dictionary words) and ideally randomly chosen ones only. Use a [[:en:mnemonic|mnemonic]] if necessary; for example, "My First Cousin Al lives in Denver" is an aid to remember "M1CA11inD" (note the use of 1 instead of L).
* Do not use a password that has been used as an example of a good one (like "M1CA11inD", which appears above).
* Use spaces, punctuation, special characters or symbols, such as =, #, /, or ©. These are permitted in all Wikimedia log-ins. Note however that some of those may be difficult to find on a foreign keyboard.
* See [[w:password strength|password strength]] for explanations and more tips.