Creating a password in 2023 be like

Obligatory https://neal.fun/password-game/

Infuriating fact: if a service has maximum password length limits (lower than 1000 characters), they're reversibly storing your password and if they're that lazy it's probably plain text

Best practice in 2023 is a simple, sufficiently long but memorable passphrase. Excessive requirements mean users just create weak passwords with patterns.
[Capital letter]basic word(number){special character}

Enforcing password changes doesnt help either. It just creates further patterns. The vast majority of compromised credentials are used immediately or within a short time frame anyway. Changing the password 2 months later isnt going to help and passwords like July2023!, which are common, are weak to begin with.

A non expiring, long, easily remembered passphase like
forgetting-spaghetti-toad-box
Is much more secure than a short password with enforced complexity requirements.

I don't get why some sites limit your usage of special characters and have miniscule max lengths?? looking at you PayPal you piece of shit

There was a website where I was making an account and it was like: no semicolons.

To this day I wonder if that was how they blocked sql injection.

Then, please give us your phone number for 2fa, instead of letting you use a more secure app

The right answer is use a password manager to generate and store a long password. Then it doesn't matter.

If for some reason you want a secure password and aren't using a password manager https://www.grc.com/passwords.htm

This is a repost :)

Does anyone use the generator from chrome anymore? Like a 2023 password for me is "suggest strong password"...

"password must contain a PUA codepoint"

Remides me of https://neal.fun/password-game/

Fuck that shit, just give me the password