\documentclass[10pt,a4paper]{article} % Packages \usepackage{fancyhdr} % For header and footer \usepackage{multicol} % Allows multicols in tables \usepackage{tabularx} % Intelligent column widths \usepackage{tabulary} % Used in header and footer \usepackage{hhline} % Border under tables \usepackage{graphicx} % For images \usepackage{xcolor} % For hex colours %\usepackage[utf8x]{inputenc} % For unicode character support \usepackage[T1]{fontenc} % Without this we get weird character replacements \usepackage{colortbl} % For coloured tables \usepackage{setspace} % For line height \usepackage{lastpage} % Needed for total page number \usepackage{seqsplit} % Splits long words. %\usepackage{opensans} % Can't make this work so far. Shame. Would be lovely. \usepackage[normalem]{ulem} % For underlining links % Most of the following are not required for the majority % of cheat sheets but are needed for some symbol support. \usepackage{amsmath} % Symbols \usepackage{MnSymbol} % Symbols \usepackage{wasysym} % Symbols %\usepackage[english,german,french,spanish,italian]{babel} % Languages % Document Info \author{Priyal kumar (pryl)} \pdfinfo{ /Title (shattering-the-myths-of-password-rules.pdf) /Creator (Cheatography) /Author (Priyal kumar (pryl)) /Subject (Shattering the Myths of Password Rules Cheat Sheet) } % Lengths and widths \addtolength{\textwidth}{6cm} \addtolength{\textheight}{-1cm} \addtolength{\hoffset}{-3cm} \addtolength{\voffset}{-2cm} \setlength{\tabcolsep}{0.2cm} % Space between columns \setlength{\headsep}{-12pt} % Reduce space between header and content \setlength{\headheight}{85pt} % If less, LaTeX automatically increases it \renewcommand{\footrulewidth}{0pt} % Remove footer line \renewcommand{\headrulewidth}{0pt} % Remove header line \renewcommand{\seqinsert}{\ifmmode\allowbreak\else\-\fi} % Hyphens in seqsplit % This two commands together give roughly % the right line height in the tables \renewcommand{\arraystretch}{1.3} \onehalfspacing % Commands \newcommand{\SetRowColor}[1]{\noalign{\gdef\RowColorName{#1}}\rowcolor{\RowColorName}} % Shortcut for row colour \newcommand{\mymulticolumn}[3]{\multicolumn{#1}{>{\columncolor{\RowColorName}}#2}{#3}} % For coloured multi-cols \newcolumntype{x}[1]{>{\raggedright}p{#1}} % New column types for ragged-right paragraph columns \newcommand{\tn}{\tabularnewline} % Required as custom column type in use % Font and Colours \definecolor{HeadBackground}{HTML}{333333} \definecolor{FootBackground}{HTML}{666666} \definecolor{TextColor}{HTML}{333333} \definecolor{DarkBackground}{HTML}{A35A1A} \definecolor{LightBackground}{HTML}{F9F4F0} \renewcommand{\familydefault}{\sfdefault} \color{TextColor} % Header and Footer \pagestyle{fancy} \fancyhead{} % Set header to blank \fancyfoot{} % Set footer to blank \fancyhead[L]{ \noindent \begin{multicols}{3} \begin{tabulary}{5.8cm}{C} \SetRowColor{DarkBackground} \vspace{-7pt} {\parbox{\dimexpr\textwidth-2\fboxsep\relax}{\noindent \hspace*{-6pt}\includegraphics[width=5.8cm]{/web/www.cheatography.com/public/images/cheatography_logo.pdf}} } \end{tabulary} \columnbreak \begin{tabulary}{11cm}{L} \vspace{-2pt}\large{\bf{\textcolor{DarkBackground}{\textrm{Shattering the Myths of Password Rules Cheat Sheet}}}} \\ \normalsize{by \textcolor{DarkBackground}{Priyal kumar (pryl)} via \textcolor{DarkBackground}{\uline{cheatography.com/66402/cs/48161/}}} \end{tabulary} \end{multicols}} \fancyfoot[L]{ \footnotesize \noindent \begin{multicols}{3} \begin{tabulary}{5.8cm}{LL} \SetRowColor{FootBackground} \mymulticolumn{2}{p{5.377cm}}{\bf\textcolor{white}{Cheatographer}} \\ \vspace{-2pt}Priyal kumar (pryl) \\ \uline{cheatography.com/pryl} \\ \uline{\seqsplit{priyal-kumar}.blogspot.com/} \end{tabulary} \vfill \columnbreak \begin{tabulary}{5.8cm}{L} \SetRowColor{FootBackground} \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Cheat Sheet}} \\ \vspace{-2pt}Published 9th June, 2026.\\ Updated 9th June, 2026.\\ Page {\thepage} of \pageref{LastPage}. \end{tabulary} \vfill \columnbreak \begin{tabulary}{5.8cm}{L} \SetRowColor{FootBackground} \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Sponsor}} \\ \SetRowColor{white} \vspace{-5pt} %\includegraphics[width=48px,height=48px]{dave.jpeg} Measure your website readability!\\ www.readability-score.com \end{tabulary} \end{multicols}} \begin{document} \raggedright \raggedcolumns % Set font size to small. Switch to any value % from this page to resize cheat sheet text: % www.emerson.emory.edu/services/latex/latex_169.html \footnotesize % Small font. \begin{multicols*}{2} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{Myth \#1: Atleast 1 digit, 1 uppercase letter, ...}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{{\bf{Myth}}: Making safe looking short passwords which satisfies all the dumb rules set by a website somehow will provide protection. \newline % Row Count 3 (+ 3) {\bf{Truth}}: \newline % Row Count 4 (+ 1) There are plenty of such rules, and they don't gurantee that a password is safe. \seqsplit{https://dumbpasswordrules}.com/sites/ \newline % Row Count 7 (+ 3) To achieve true security, focus on entropy—the actual randomness and length of your credential. The longer and more unpredictable the string, the higher its entropy, and the harder it is to break. \newline % Row Count 11 (+ 4) Instead of traditional "8 characters with one capital, number, and symbol", aim for a minimum of {\bf{16 characters or more}}. 8-9 character passwords are just not long enough. \newline % Row Count 15 (+ 4) A long string of 5 to 6 unrelated words is extremely difficult for brute-force tools to crack, yet easy for humans to remember. (e.g., Horse-Purple-Hat-Run-Bay or \seqsplit{CorrectHorseBatteryStapleTrainAlien)}. \newline % Row Count 20 (+ 5) https://xkcd.com/936/ \newline % Row Count 21 (+ 1) You can check how long it'll take for an hacker to crack your password: \seqsplit{https://lowe.github.io/tryzxcvbn/} \newline % Row Count 24 (+ 3) Don't worry, it's a webapp, stays in your browser, nothing is being transferred to the servers.% Row Count 26 (+ 2) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{Myth \#2: Never write down a password}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{{\bf{Myth}}: Written passwords can be stolen. \newline % Row Count 1 (+ 1) {\bf{Truth}}: Never fear writing your passwords down. Ironically, the dread of a physical thief causes people to create weak, easily hackable passwords. \newline % Row Count 5 (+ 4) Security professionals agree—it is vastly safer to write complex, 16-character passwords in a physical notebook kept secure at home than to memorize weak passwords% Row Count 9 (+ 4) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{Myth \#3: The Password Rotation}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{{\bf{Myth}}: It's always a good idea to change the password after every few months. \newline % Row Count 2 (+ 2) {\bf{Truth}}: Don't bother updating your password regularly. Sites that require 90-day -{}- or whatever -{}- password upgrades do more harm than good. {\bf{Unless you think your password might be compromised, don't change it.}} \newline % Row Count 7 (+ 5) Check if your password is already been leaked in a historical data leak: \seqsplit{https://haveibeenpwned.com/Passwords} \newline % Row Count 10 (+ 3) A survey of 200 people conducted by security outfit HYPR has some alarming findings. \newline % Row Count 12 (+ 2) For instance, not only did 72\% of users admit that they reused the same passwords in their personal life, but also 49\% admitted that when forced to update their passwords in the workplace they reused the same one with a minor change. \newline % Row Count 17 (+ 5) Forced changes don't trick hackers; they just exhaust users into creating predictable patterns that automated cracking tools guess. Keep a strong password until a breach actually demands a change.% Row Count 21 (+ 4) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{How Passwords Get Compromised}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{{\bf{Phishing}}: Attackers don't always hack their way in; often, they just ask. Phishing involves deceptive emails, fake login pages, or spoofed messages designed to trick you into voluntarily typing your credentials directly into a hacker's database. \newline % Row Count 5 (+ 5) {\bf{Network Sniffers}}: If you connect to insecure or unencrypted Wi-Fi (like public hotspot networks), attackers can deploy "sniffers". This software intercepts data moving through the airwaves, capturing any passwords transmitted in plain text. \newline % Row Count 10 (+ 5) {\bf{Keyloggers}}: This malicious software or hardware silently infects a device to record every single keystroke you type. It captures your master passwords and PINs in real-time, completely bypassing browser encryption. \newline % Row Count 15 (+ 5) {\bf{Brute force or Cracking}}: Using specialized software, hackers cycle through millions of character combinations or known common phrase lists per second until they guess the correct match. \newline % Row Count 19 (+ 4) {\bf{Weak passwords}}: Short, predictable passwords that are just too easy to guess. Here's a list of some of the most common and unsafe passwords: \seqsplit{https://en.wikipedia.org/wiki/List\_of\_the\_most\_common\_passwords} \newline % Row Count 24 (+ 5) {\bf{Reuse of passwords and use of compromised passwords}}: Reusing identical combinations across multiple platforms, or continuing to use a phrase after it has appeared in a known public data leak. \newline % Row Count 28 (+ 4) {\bf{Clear text passwords in code and config. files}}: Leaving passwords written in plain, unencrypted text inside software source code or system configuration files where anyone with server access can read them.% Row Count 33 (+ 5) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{Diceware method}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{Diceware method ensures that the words you're picking are actually random rather than what you think is random. The passwords are also super easy to remember. \newline % Row Count 4 (+ 4) When using this method, make sure that the passwords are {\bf{atleast 6 words long}}. \newline % Row Count 6 (+ 2) Passphrases of six words or more are considered safe for online banking, or high-security applications. \newline % Row Count 9 (+ 3) Four words only provide about the same entropy as an 8 character password made up of random ASCII characters. \newline % Row Count 12 (+ 3) According to the creator of Diceware Reinhold, six words may be breakable by an organization with a very large budget, such as a large country's security agency. Seven words and longer are unbreakable with any known technology, but may be within the range of large organizations by around 2030. Eight words should be completely secure through 2050. \newline % Row Count 19 (+ 7) Here's a good explanation of how this method works by Computerphile: \newline % Row Count 21 (+ 2) Diceware \& Passwords - \seqsplit{https://www.youtube.com/watch?v=Pe\_3cFuSw1E} \newline % Row Count 23 (+ 2) Interested in learning more about Diceware: https://theworld.com/\textasciitilde{}reinhold/dicewarefaq.html \newline % Row Count 25 (+ 2) Diceware method is even recommended by EFF. https://www.eff.org/dice \newline % Row Count 27 (+ 2) Here are some Diceware lists you can use: \newline % Row Count 28 (+ 1) \seqsplit{https://www.eff.org/files/2016/07/18/eff\_large\_wordlist.txt} \newline % Row Count 30 (+ 2) } \tn \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{Diceware method (cont)}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{\seqsplit{https://www.eff.org/files/2016/09/08/eff\_short\_wordlist\_1.txt} \newline % Row Count 2 (+ 2) \seqsplit{https://www.eff.org/files/2016/09/08/eff\_short\_wordlist\_2\_0.txt} \newline % Row Count 4 (+ 2) \seqsplit{https://www.rubin.ch/pgp/diceware.doc} \newline % Row Count 5 (+ 1) \seqsplit{https://theworld.com/\%7Ereinhold/beale.wordlist.asc} \newline % Row Count 7 (+ 2) \seqsplit{https://docs.google.com/spreadsheets/d/1KzFglmCKr4Q8AWOFE5QFywOuSdRA\_DDFs1M9BFXGZL4/edit?usp=sharing} \newline % Row Count 10 (+ 3) \seqsplit{https://web.archive.org/web/20080312042519/https://www.ibm.com/developerworks/library/s-pass2/index.html} \newline % Row Count 13 (+ 3) If you are lazy, or just don't want to manage the effort to roll the dice, use these alternatives: \seqsplit{https://www.mouseware.org/} \newline % Row Count 16 (+ 3) \seqsplit{https://diceware.rempe.us/\#eff}% Row Count 17 (+ 1) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{x{3.42 cm} x{3.344 cm} p{0.836 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Passwords and their strengths}} \tn % Row 0 \SetRowColor{LightBackground} elephant1234 & \hspace*{0.02 cm}\rule{1.18cm}{6px} & 58 \tn % Row 1 \SetRowColor{white} cat-walrus\_traiN & \hspace*{0.02 cm}\rule{2.02cm}{6px} & 100 \tn % Row 2 \SetRowColor{LightBackground} /*-+.\textbackslash{}{]}{[} - & \hspace*{0.02 cm}\rule{0.9cm}{6px} & 44 \tn % Row 3 \SetRowColor{white} doggo007 & \hspace*{0.02 cm}\rule{0.72cm}{6px} & 35 \tn % Row 4 \SetRowColor{LightBackground} 9452718465 & \hspace*{0.02 cm}\rule{0.54cm}{6px} & 26 \tn % Row 5 \SetRowColor{white} trainNo.\#4886 & \hspace*{0.02 cm}\rule{1.7cm}{6px} & 84 \tn % Row 6 \SetRowColor{LightBackground} 123@9 & \hspace*{0.02 cm}\rule{0.4cm}{6px} & 19 \tn % Row 7 \SetRowColor{white} !smartkittly99\% & \hspace*{0.02 cm}\rule{1.84cm}{6px} & 91 \tn % Row 8 \SetRowColor{LightBackground} sId & \hspace*{0.02 cm}\rule{0.16cm}{6px} & 7 \tn % Row 9 \SetRowColor{white} Fast\&furiou\$ & \hspace*{0.02 cm}\rule{1.52cm}{6px} & 75 \tn % Row 10 \SetRowColor{LightBackground} *daydreamer & \hspace*{0.02 cm}\rule{1.24cm}{6px} & 61 \tn \hhline{>{\arrayrulecolor{DarkBackground}}---} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{Myth \#4: The Passwordless}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{{\bf{Myth}}: One can completely eliminate passwords by switching to FaceID or fingerprint readers. \newline % Row Count 2 (+ 2) {\bf{Truth}}: {\bf{Biometrics replace usernames, not passwords}}. Your face or fingerprint identifies who you are, but your biometrics aren't a secret. Passwords are secrets. \newline % Row Count 6 (+ 4) {\bf{Passwordless means passwords will be used less}}. It doesn't mean they disappear completely% Row Count 8 (+ 2) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{Password cracking}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{There are commercial programs that do password cracking, sold primarily to police departments. There are also hacker tools that do the same thing like \seqsplit{https://openwall.com/john/} \newline % Row Count 4 (+ 4) As computers have become faster, they're able to test more passwords per second, {\emph{10s of millions per second}}. These crackers might run for days, on many machines simultaneously. For a high-profile police case, they might run for months. \newline % Row Count 9 (+ 5) The efficiency of password cracking depends on two largely independent things: {\bf{computing power}} and {\bf{efficiency}}(ability to guess passwords cleverly, e.g. try the most common passwords first).% Row Count 13 (+ 4) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{How to Choose a Password - Computerphile}} \tn \SetRowColor{LightBackground} \mymulticolumn{1}{p{8.4cm}}{ Video: http://youtu.be/3NjQ9b3pgIg} \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{Use Password generators}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{Use these password generators (make sure to {\bf{change password length to atleast 16 characters}}): \seqsplit{https://www.intuitivepassword.com/en/Tools/PasswordGenerator} \newline % Row Count 4 (+ 4) \seqsplit{https://us.norton.com/feature/password-generator\#password\_generator} \newline % Row Count 6 (+ 2) Password generation {\bf{using abbreviated phrases}}: \seqsplit{https://rmmh.github.io/abbrase/} \newline % Row Count 8 (+ 2) Password generator android app: \seqsplit{https://play.google.com/store/apps/details?id=de.aregel.advancedpasswordgenerator}% Row Count 11 (+ 3) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{How to store Passwords}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{A {\bf{password manager}} is a software program that prevents password fatigue by automatically generating, autofilling, and storing passwords. Here are some you can download and use for free: \newline % Row Count 4 (+ 4) {\bf{RoboForm}}: It has been a reliable name in password management since 1999. Its free version offers great value with unlimited logins on a single device, and college students can even grab a full year of premium for free. For users on the move, it features a unique portability option that lets you run the app directly from a USB drive across different computers. \newline % Row Count 12 (+ 8) {\bf{Bitwarden}}: Offers a transparent, community-vetted architecture ideal for modern, secure syncing across devices. \newline % Row Count 15 (+ 3) {\bf{KeePass}}: Provides total isolation by storing passwords strictly in a local, encrypted database (no automatic syncing). As FOSS, its massive ecosystem of third-party plugins allows endless functionality extensions across almost any device, browser, or platform.% Row Count 21 (+ 6) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{Definitely use MFA}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{If a site offers {\bf{multi-factor authentication(MFA)}}, seriously consider using it. It adds a critical extra layer of defense by requiring multiple pieces of evidence to prove your identity: \newline % Row Count 4 (+ 4) {\bf{What you know}}: Passwords, PINs, or security questions. \newline % Row Count 6 (+ 2) {\bf{What you have}}: Mobile apps (software tokens), hardware keys, OTP SMSs, emails, or digital certificates. \newline % Row Count 9 (+ 3) {\bf{Who you are}}: Biometrics like fingerprints or facial recognition. \newline % Row Count 11 (+ 2) {\bf{Where you are}}: Location-based checks like your IP address or GPS.% Row Count 13 (+ 2) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{8.4cm}}{\bf\textcolor{white}{Sources}} \tn \SetRowColor{white} \mymulticolumn{1}{x{8.4cm}}{\seqsplit{https://cypressdatadefense}.com/blog/password-security-risks/ \newline % Row Count 2 (+ 2) \seqsplit{https://web.archive.org/web/20220214162332/https://outline.com/dqfuqL} \newline % Row Count 4 (+ 2) \seqsplit{https://grahamcluley.com/49-of-workers-when-forced-to-update-their-password-reuse-the-same-one-with-just-a-minor-change/} \newline % Row Count 7 (+ 3) College students can get Roboform free for an year: \seqsplit{https://www.roboform.com/promotions/college-verify} \newline % Row Count 10 (+ 3) Check the strength of your password: \seqsplit{http://password-checker.online-domain-tools.com/} \newline % Row Count 12 (+ 2) Making a secure password by the security expert Bruce Schneier: \seqsplit{https://web.archive.org/web/20190825152420mp\_/https://boingboing.net/2014/02/25/choosing-a-secure-password.html} \newline % Row Count 16 (+ 4) \seqsplit{https://web.archive.org/web/20211228191634/https://arstechnica.com/information-technology/2014/03/diceware-passwords-now-need-six-random-words-to-thwart-hackers/}% Row Count 20 (+ 4) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} % That's all folks \end{multicols*} \end{document}