Reality check: A public service announcement about passwords

If anyone ever says to you, “your password must contain one capital, a digit,…”, you can be certain that they are an idiot, and that they do not understand security. If you encounter such requirements in software, then it was written by an idiot—or it was written to a standard which was written by an idiot.

I’m serious. This is not hyperbole. Anyone who says such things truly has not even the most basic understanding of computer security. You should immediately stop trusting them with anything related to computer security.

To begin to understand why this is true, please enjoy this wonderfully explanatory cartoon from XKCD: Password Strength.

The cartoon is fun, but its core point about the critical feature of your passwords being the amount of entropy they contain will make you smarter than the vast majority of people.

ɕ

#RandallMunroe #XKCD

#xkcd No. 3250
Date: 2026-5-25
Title: Flag Design
Alt text: Every place has a local cryptid; more places need a local Pictish Beast, a creature in historical art that's drawn so weirdly that no one can tell what animal it's supposed to be.
https://xkcd.com/3250/

#xkcd No. 3250
Date: 2026-5-25
Title: Flag Design
Alt text: Every place has a local cryptid; more places need a local Pictish Beast, a creature in historical art that's drawn so weirdly that no one can tell what animal it's supposed to be.
https://xkcd.com/3250/

#xkcd No. 3250
Date: 2026-5-25
Title: Flag Design
Alt text: Every place has a local cryptid; more places need a local Pictish Beast, a creature in historical art that's drawn so weirdly that no one can tell what animal it's supposed to be.
https://xkcd.com/3250/

xkcd #3250: Flag Design

https://lemmy.world/post/47347780

#xkcd: Neutrino Project https://xkcd.com/3249/