Your Password Has Rules. Hackers Know Them.

Capital letter. Number. Symbol. The warning disappears and the checkmark turns green. So why can a password that passes every rule still be easy to guess? The form checks what your password contains. It doesn't check how you chose it, and people who guess passwords can start with the choices people actually make. Follow one person trying to book a faucet repair through guessing, a stolen copy of the password data, reuse, and a fake login page. Then see what actually helps: meters that explain, password managers that generate, passkeys, and current federal guidance. The faucet owner, the repair site, and every account in this video are fictional. No cracking time is given for the made-up password: it was never measured under a defined attack. Studies are described within their own methods and limits; none of them is a universal success rate. SOURCES NIST SP 800-63B-4: Digital Identity Guidelines, authentication (passwords, section 3.1.1) https://pages.nist.gov/800-63-4/sp800... Ur et al.: "I Added '!' at the End to Make It Secure": Observing Password Creation in the Lab (SOUPS 2015). Think-aloud study, 49 participants, fictional accounts. https://www.usenix.org/system/files/c... Komanduri et al.: Of Passwords and People: Measuring the Effect of Password-Composition Policies (CHI 2011) https://users.ece.cmu.edu/~lbauer/pap... Tan et al.: Practical Recommendations for Stronger, More Usable Passwords Combining Minimum-strength, Minimum-length, and Blocklist Requirements (CCS 2020) https://www.andrew.cmu.edu/user/nicol... Ur et al.: Measuring Real-World Accuracies and Biases in Modeling Password Guessability (USENIX Security 2015) https://www.usenix.org/system/files/c... Ur et al.: Design and Evaluation of a Data-Driven Password Meter (CHI 2017). 4,509 participants completed the first part of the online study. https://www.andrew.cmu.edu/user/nicol... Nisenoff et al.: A Two-Decade Retrospective Analysis of a University's Vulnerability to Attacks Exploiting Reused Passwords (USENIX Security 2023). Results belong to that institution and its data. https://www.usenix.org/system/files/u... RFC 9106: Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications (2021) https://datatracker.ietf.org/doc/html... W3C: Web Authentication, Level 3 (passkeys) https://www.w3.org/TR/webauthn-3/ Pearman et al.: Why People (Don't) Use Password Managers Effectively (SOUPS 2019) https://www.usenix.org/conference/sou... THE HEADLINE The familiar recipe, included as context: a legacy Microsoft page whose strong-password table lists a mix of character types. The same page notes that meeting the criteria does not guarantee a strong password. https://learn.microsoft.com/en-us/win... CHAPTERS 0:00 The Check Mark 1:31 A Room of Drawers 3:14 The Rules, the Copy, the Clock 7:00 The Same Secret, Somewhere Else 9:19 What Actually Helps 12:31 Three Questions ABOUT THIS VIDEO The narration voice is synthetic (text-to-speech). The background music and sound effects are AI-generated. Every character, illustration, and animation is drawn in code for this video. Not The Headline: the headline tells you what sells. We explain what's actually happening. #Passwords #Cybersecurity #Passkeys