What is a Password?
Passwords, told as a story about the secret word you whisper to the gatekeeper.
The gatekeeper asks for the password. The thief tries to guess it, one word at a time.If the word is something short like Apple, the thief gets it in a few tries. Thieves don't get tired.
A short word is guessed fast; the same word everywhere means one leak opens every door.And the thief already owns a list of the words everyone uses. Apple, 1234, and password sit right at the top.
A password is the secret word you whisper to the gatekeeper.Only the gatekeeper and I know it. Long, different at every door, kept in a box, and told to no one.
The words live in a locked box, and I remember only the key to the box.A hundred doors, one thing to remember. For a new door the box invents a long strange word, and hands it to me every time I go.
If it leaks, change that door's word. And a good gatekeeper asks for one thing more.If my word shows up on the leaked list, I change only that door — every door has its own. The gatekeeper also checks one more thing, or looks at a ring instead.
Password = a whispered word only the gatekeeper and I know. Long, different at every door, kept in a locked box, and told to no one.
A secret string that proves I am me. Short, reused, or common passwords fall quickly to brute force and credential stuffing. Passphrases, password managers, and MFA cover those weak spots.
When grown-ups say it
- Passphrase
- A password that is a sentence. Purple whale bakes bread. Easy to remember, far harder to guess — length beats weird characters.
- Password manager
- The locked key box. Invents and remembers a long, different password for every door. I remember only the box key — the master password.
- Password reuse
- The same word at every door. Leak it at one castle and every other gate opens too. The first thing a thief tries.
- Credential stuffing
- Trying a leaked list at every gate. A list of names and words leaked elsewhere, tried one by one at our gate. Not reusing passwords stops it cold. → the thief with a thousand keys
- Hashing
- The gatekeeper writes down a fingerprint, not the word. Even the gatekeeper never writes the word itself — only its fingerprint, compared when I speak. → a fingerprint for everything
- MFA
- One more thing besides the word. The ring or the phone code, asked along with the word. A leaked word still opens nothing. → the gatekeeper who checks three times
- Passkey
- A ring instead of a word. Nothing to remember, nothing to whisper — nothing to leak. → the ring that knows its gate
- Breach check
- Reading the leaked list. Services like Have I Been Pwned tell you if your word is on a leaked list. If it is, change that one door.