In the press 

In recent months, NordPass has made some appearances in the media. In some cases, we shared our knowledge and insights into cybersecurity developments. In others, NordPass was the one under the microscope.

PCMag Editor’s Choice

The team at NordPass always strives to grow and improve, bringing you the best password management experience. That’s why it’s been an honor to be selected as PCMag’s Editor’s Choice and take the top spot as the Best Premium Password Manager for 2024. NordPass’ ease of use, slick design, and additional cybersecurity features like Password Health and Data Breach Scanner were highlighted as some of the standouts of our product.

We’re not resting on our laurels, though. This recognition has only made us more determined to stay on top of the game and bring even more robust security features to our user base.

Discussing passkeys with Andrew Shikiar

Earlier this year, NordPass CEO Jonas Karklys sat down with Andrew Shikiar, Executive Director and CEO of the FIDO Alliance, to discuss all things passwordless. During the talk, they went over the early adoption of passkeys and their growth within the past couple of years, the public perception of this technology, and how it aligns with recent and upcoming compliance regulations.

NordPass has been a proud member of the FIDO Alliance since 2022, so the opportunity to discuss the developments in passwordless technology with the organization’s CEO has only strengthened our team’s understanding of what passkeys have to offer. Karklys went on to share his own insights about passkeys in his article on TechRadar.

Joining forces with Factory Berlin

Partnerships help keep our global community strong. That’s why we’re excited to start our partnership with Factory Berlin. Thanks to this new opportunity, we will be able to connect with up-and-coming startups, innovators, and creators.

Factory Berlin creates a space that helps support startups and grants access to resources and networking opportunities. We look forward to sharing our experiences, trading knowledge, and unlocking brand-new opportunities with this community.

Recent product news

It’s not just about talking the talk — we’re ready to walk the walk, too. These past few months have been very productive for us, with several new NordPass features and releases that we’re very excited about.

Detailed Shared Folders actions for Business

We want to bring efficiency and transparency to your organization’s data security by making our features easy to track and effortless to navigate. That’s why you may have noticed some changes and refinements to the NordPass Activity Log feature.

The Activity Log now displays all actions related to Shared Folders, such as when shared access was granted or revoked, what access level was set, which credentials were moved to or from the folder, and if the folder was renamed at any point. It provides more visibility into password management within your organization and offers insights similar to those of the NordPass Activity Log for your individual credentials.

Authenticator with autofill for Business

NordPass Authenticator allows users to add and store two-factor codes directly in their vaults alongside login credentials using NordPass, making it quick and easy to log in with multi-factor authentication when you are on a tight schedule. From now on, whenever you generate time-based one-time passwords (TOTPs) using NordPass Authenticator, you’ll have them autofilled in the login screen. 

By introducing this new mechanism to our Authenticator, we help you optimize multi-factor logins, bringing a higher security standard to your company account security. It resolves the long-standing problem of multi-factor authentication fatigue caused by using multiple apps and manually inputting security information to log in to an account. With the Authenticator, you don’t need to spend precious time switching apps or ensuring you’ve copied or memorized the right sequence before it refreshes and resets — NordPass handles it for you.

Splunk integration and Activity Log API for Enterprise

Clear and transparent documentation is crucial when a company works toward gaining compliance approvals. To make these management processes smoother, we’re excited to be joining forces with Splunk. This new partnership will allow NordPass customers who use Splunk to get automated activity analysis and generate reports for simpler data visualization.

As part of the optimization of data reports, NordPass now allows Admins to extract the full activity log information with the Activity Logs API. Using the API, organizations can monitor their employees’ actions and investigate company-wide activities for potential risks.

User and Group Provisioning via Okta for Enterprise

NordPass aims to make user and group management simpler without compromising security. If your organization’s provisioning system of choice is Okta, we have great news. You can now easily set up User and Group Provisioning in NordPass using your organization’s Okta account.

By combining Okta with NordPass, you can effectively handle onboarding and offboarding, manage access to resources as well as internal and third-party systems, and adhere to your organization’s cybersecurity policies.

Tweaks and improvements

While bringing new features to our users helps expand our cybersecurity capabilities, we haven’t forgotten what we’ve been working on so far. Consistency is key, and our goal is to continue improving and perfecting every feature that NordPass has to offer. We’re always eager to receive your feedback and work hard to improve your experience with NordPass, whether you’re with us for personal or business needs.

Adding dates to Custom Fields

With Custom Fields, we aim to give you more control and flexibility over how you store your sensitive information. We’re always thinking of new ways to expand Custom Fields to suit our customers’ needs — the most recent being the introduction of Date Fields.

From now on, you can select “Add date” and use the calendar to set it. Add a custom name to your date to know its function, for example, when a credential was created, when an ID document expires, or when an account needs updating. This addition will let you flexibly manage your sensitive data and offer a more convenient way to track time-sensitive information.

Authopia is here

Last but not least, we want to spotlight Authopia — a new tool developed by the team behind NordPass. Authopia lets you easily add a passkey widget to a login form on any website or service, making passwordless logins effortless and more accessible than ever before.

Authopia aims to offer companies a simpler passkey implementation method that requires minimal coding and is completely free, suiting organizations of all sizes and budgets. You can learn more about Authopia’s journey from development to launch from Sorin Manole, Head of Product, R&D at NordPass.

Bottom line

Overall, this has been an eventful quarter for NordPass, and we couldn’t be more proud of everything we’ve achieved. Our work for the year is far from over, though — we’ve still got a lot up our sleeves, and we’re not slowing down. We’re happy to have you with us on this journey so far, and we hope you’ll stay tuned and stay safe with NordPass.

What is a good password? 

You might think that the answer to this question would be very subjective, but that’s far from the case. In simplest terms, a good password is one that’s difficult to crack. The stronger your password is, the better it works to protect your accounts from hackers and other malicious actors. A strong, reliable password can sometimes take millions of years to crack, which means that the hackers are less likely to even try to gain them.

When you’re thinking of good password ideas, you need to keep the following criteria in mind:

• The password should be at least 12-15 characters long.

• It should use a combination of letters, numbers, and special characters. Spaces are also allowed.

• It should not be a common word, product, character, name, or anything you can easily find in a dictionary.

• It should be a combination that only you know and others could not easily predict. We’ll cover some creative password ideas shortly.

• Each password should be unique and you shouldn’t reuse them for several accounts. If a password you use on several platforms is cracked, that puts all of your accounts at risk.

What is considered a weak password?

Weak passwords consist of sequential letters or numbers, are fewer than eight characters long, or use common words and phrases. The most popular passwords are well-known by malicious actors and are usually what they try first.

According to NordPass’ annual top 200 most common passwords list, “123456” and “password” are the most commonly used and vulnerable passwords. Another example of a weak password would be using the name of a fictional character like “Superman,” “Batman,” or “Joker.”

Examples of bad passwords

Here are some more examples of weak, easy-to-crack passwords:

• 123456789

• abc123

• qwerty

• iloveyou

• hello

• computer

• password123

If you’re wondering whether your passwords might be weak links, check out the list of the top 200 most common passwords. You’ll find even more examples, as well as some fun facts about the most common passwords around the world.

The most common password-cracking techniques

Brute-force attack

During a brute-force attack, a malicious actor uses software that tries every possible combination to find the right one. An eight-character password consisting of upper- and lowercase letters, numbers, and special characters can be cracked in just two hours. Good passwords will take months or even years to break through, depending on their uniqueness and complexity.

Dictionary attack

While brute-force attacks try various combinations of special characters, numbers, and letters, a dictionary attack uses a program that goes through a prearranged list of words. Essentially, if your password can be found in a dictionary, specialized software can easily crack it.

Phishing

Phishing is a social engineering method to trick people into revealing their credentials. Phishing attacks often use email services as a medium: hackers send emails pretending to be reputable sources and refer users to fake login pages. A user then inputs their login credentials themselves and inadvertently grants this information to the hackers.

Credential stuffing

Credential stuffing is a popular method for hackers to gain access by collecting usernames and passwords used in previous attacks and trying them on other platforms. This method often proves successful because people tend to reuse the same password for all their accounts.

Keylogging

Keylogging involves a specific type of malware, known as keylogger, infecting the victim’s device. The keylogger can then track the user’s keystrokes and device activity, depending on the software and the device. This can include copied and pasted data, phone calls, location, and screenshots. Using this information, hackers can easily access passwords and other sensitive information, allowing them to launch further attacks on the individual or data from their place of work.

How to create a strong password

• The longer your password is, the better. Many websites ask you to create eight-character passwords, but we recommend going for at least 15 characters.

• Avoid ties to your personal information, such as your name, surname, address, or date of birth.

• Use a combination of numbers, symbols, and upper- and lowercase letters in random order.

• Don’t use sequential letters and numbers.

• Avoid substitution: “kangaroo” and “k@ng@r00” are both equally weak passwords, and a brute-force attack can easily crack them.

• Don’t reuse the same password for multiple accounts.

With our free password security tool, you can check your password strength and if it has been exposed in any data breaches. You can also try the Password Health feature with NordPass Premium. It scans all passwords that you’ve saved in your Vault and checks for vulnerabilities.

Top 5 strong password ideas

Coming up with a strong and unique password can be a challenge. To make this process easier for you, we’ve gathered some examples that will help protect your data and accounts from being breached and taken over. We’ve also included some formulas and passphrase examples that you can try yourself. However, we highly recommend you don’t use the example passwords for your accounts.

1. Shorten each word

Think of a phrase and remove the first three letters of each word (in some cases, that might mean deleting full words, but that’s fine):

“Laptop running free in the jungle” -> “top ning e gle”

Sounds like gibberish? That’s exactly what we want. Just don’t forget to add special characters and numbers to make it more complicated. It would take 94,000 years to crack this password.

2. Create your own formula

Create a formula that will help you remember the password. For example, you can take a phrase and replace every letter with the next one in the alphabet:

“Cucumbers are tasty” -> “dvdvncfst bsf ubtuz”

Another clever way of creating strong passwords is to turn song lyrics into acronyms. This means using only the first letter of each line of your favorite song.

So, “Shine on you crazy diamond” by Pink Floyd becomes “rsnsybccystswrcc.”

The time needed to crack this password is 746 million years.

3. Play with the vowels

This one is much easier to implement and memorize: take a random nonsensical phrase and replace one vowel with another (for example, “a” with “e”):

“A car is floating in a pan” -> “e cer is floeting in e pen”

Don’t forget – spaces are allowed in passwords, and we highly encourage you to use them. The combination of having spaces and switching the vowels around means the above password would take 583 million trillion years to crack.

4. Mix the codes of your favorite countries

This one is quite fun and easy to memorize. You will always generate good passwords with this method. Simply make a list of the ISO codes of your favorite countries and put them together:

“Mexico, Ireland, France, Germany, Japan” -> “mex irl fra deu jpn”

You wouldn’t think so, but a hacker would require a staggering six thousand trillion years to crack this password!

If you want to spice things up and make them even more difficult to crack, you can also add each country’s calling code:

“mex54 irl353 fra33 deu49 jpn81”

Such a password would take 12 decillion years years to crack. How impressive is that?

5. Use a password manager

If creating and remembering random phrases for all your accounts seems too complicated, you can use a password manager, such as NordPass. It’s an easy-to-use app that lets you generate strong, unique passwords and securely store them in an encrypted Vault. You can also easily use NordPass to autofill online forms and fields.

You can add as many passwords as you need and access them from any device. This way, you can get the best of both worlds by combining your creative password ideas with one-of-a-kind secure ones created by the password manager for each account without the risk of forgetting them. You can use a special code and get an additional month of NordPass Premium for free when you purchase a two-year plan.

Additional tips

Here are some more tips to keep in mind when you’re looking for good password ideas:

• In order to protect your data, remember that passwords must be difficult to predict. Including special characters and spaces increases the time it takes for your password to be cracked.

• Take your phone security into consideration. According to research, pattern locks are successfully replicated around 64% of the time. Instead, set up a PIN or use our guide to generate some strong phone password ideas.

• Don’t forget to implement new password ideas for work. Don’t reuse your personal passwords because if they ever get breached, your work accounts could be in danger, too.

• Always use multi-factor authentication (MFA). Even if your password is definitively strong, accidents can happen and your first line of defense might be breached. Using MFA means that no one can access your accounts without accessing your authentication device. NordPass uses multi-factor authentication to add an additional layer of security to your password vault.