Password length

6.5 Explain password best practices.

📘CompTIA ITF+ (FC0-U61)

---

1. Why Password Length Matters

• Computers can try billions of password combinations very quickly. This is called a brute-force attack.
• Short passwords (like 4–6 characters) can be cracked very fast.
• Longer passwords (12+ characters) take exponentially longer to crack, even if the attacker knows the method.
• In IT environments, strong passwords help protect:
  • User accounts on servers or workstations
  • Email accounts
  • Databases
  • Network devices like routers or firewalls

2. Recommended Password Lengths

• Minimum length: 8 characters (some older systems may allow shorter, but not recommended)
• Better security: 12–16 characters
• High security systems: 20+ characters (used for admin accounts or critical systems)

Tip: Always follow your organization’s password policy. Many IT systems enforce minimum lengths automatically.

3. Longer Passwords Are More Secure

• Password strength is not just about letters, numbers, and symbols, but also length.
• Example in an IT environment:
  • A password for a database login: Db2026!Secure → 13 characters, strong enough to resist attacks
  • A short password like Db26! → only 6 characters, can be cracked very fast
• In corporate networks, even if a password has numbers and symbols, if it’s short, attackers can still guess it quickly using automated tools.

4. Password Policies in IT Systems

Many IT systems and software require a minimum password length for security. Examples:

• Active Directory (Windows servers): often requires at least 8 characters for users
• Linux systems: passwd command can enforce minimum length and complexity
• Email servers / SaaS platforms: usually require 12 characters or more
• Some systems even prevent passwords that are too short to stop weak passwords from being used at all.

5. Best Practice Tips for Password Length

• Always use at least 12 characters for user accounts
• For admin or critical accounts, use 16–20 characters or more
• Combine letters, numbers, and symbols for even better security, but focus on length first
• Avoid extremely short passwords, even if they include symbols — length matters more than complexity alone

---

Summary for Exam:

• Password length is key for security — longer passwords are harder to guess.
• Minimum: 8 characters, recommended: 12–16, critical accounts: 20+.
• Many IT systems enforce minimum lengths automatically.
• Focus on length first, then complexity.