强密码指南：怎么生成并管理不重复的密码

The Three Pillars of a Strong Password

Whether a password is strong comes down to exactly three things:

1. Length: the most effective source of strength. Each extra character multiplies the search space by the alphabet size (×62 for letters+digits);
2. Randomness: no pattern in any position. Passwords typed "off the top of your head" almost always contain patterns — common words, keyboard walks, predictable substitutions (a→@);
3. No reuse: a great password shared across ten sites is only as strong as the weakest of those sites. Breaches happen; reuse is what turns one breach into ten.

Put together, the practical standard is: one independently generated random password per account, 16+ characters. Memorizing dozens of these is impossible — which is why the third pillar points to the password manager below.

Entropy: The Ruler of Password Strength

"Strong" is vague; cryptography quantifies it with entropy, measured in bits — how many binary guesses an attacker needs on average. It depends on exactly two things: alphabet size × length, provided every character is truly random.

Each character contributes roughly log2(alphabet size) bits:

Useful baselines: 80+ bits is comfortable against offline cracking; 100+ bits is effectively unguessable with foreseeable hardware. By contrast, a password assembled from common words plus a year — however long and however many exclamation marks — often carries under 20 bits of real entropy, because every choice in it was made by a human. That's why "P@ssw0rd2024" is worthless: the character classes look fancy, but nothing is random.

So don't try to stuff symbols in yourself — let a machine pick. Generate a 16–32 character random string with the Password Generator, where length and alphabet are explicit and the entropy is computable at a glance.

Working With a Password Manager

The manager solves "what happens after generation". The division of labor is simple:

1. The manager stores: dozens of random passwords sit encrypted in one vault with autofill — you only memorize a master password;
2. The generator makes them: when signing up anywhere, generate a fresh one with the random Password Generator — 16+ characters, full alphabet, unique per site — and save it to the vault immediately;
3. Harden the master password: it's your single point of failure — make it longer (a ~20-character random string, or 4–5 unrelated random words) and enable two-factor authentication;
4. Backstop the key account: your email is the reset gate for everything else, so its password and 2FA come first in priority.

When choosing a manager, check three things: zero-knowledge encryption (the vendor can't decrypt your vault), open source or independently audited, and solid autofill with cross-device sync. Browser "save password" features are a stopgap, without dedicated generation or guaranteed encryption strength.

About Look-Alike Characters

Many generators offer an "exclude look-alike characters" option that drops l / 1 / I and O / 0. Whether to use it depends on the scenario:

• Copy-paste scenarios: don't exclude. Web and app logins paste or autofill the string — look-alikes can't be misread, and the full alphabet means slightly more entropy;
• Human-transcription scenarios: exclude them. Wi-Fi passwords read aloud to guests, printed on a meeting-room wall, or handwritten on a sticky note — here l1I0O is a disaster, so tick the exclusion; incidentally, turning the Wi-Fi password into a QR code lets guests scan to join and skips dictation entirely (see the QR Code Generator);
• The cost: removing five characters shrinks the alphabet from 62 to 57, dropping a 16-character password from ~95 to ~93 bits. A tiny loss that fully pays off whenever a human has to read it.

Hyphen grouping (like k7m2-qp9x) exists purely for easier reading aloud and transcription — paste the whole thing as one string.

Why Personal Information Makes Terrible Passwords

"Name + birthday" is the most intuitive password material — which is exactly why attackers try it first. A targeted attack's dictionary is typically built in this order:

1. Your name, its romanization, initials, nicknames, and handles;
2. Birthday, phone number, anniversaries, employee ID;
3. Common words + year, with rule-based twists (capitalize, reverse, append !, a→@);
4. Previously breached passwords and their near-variants.

The first two categories are public on social profiles, company pages, and photo EXIF data; the last two ship as defaults in every cracking tool. The subtler trap is patterned reuse: "name + first letter of the site" looks unique per site, but once one breached account reveals the rule, every account falls with it.

The conclusion is simple: password material must have zero connection to who you are, and only machine randomness guarantees that. Generate, store in a manager, and memorize one master password — this flow sidesteps every trap above. And once you've changed a password, copy the 2FA recovery codes into the vault's secure notes as well.

FAQ