PASSWORD GAUNTLET
The Gauntlet — Test a Password
Passphrase Workshop
Diceware-style: random words beat clever substitutions. Click any word to re-roll just that word, or re-roll all. Then test your creation in the Gauntlet above.
Why It Works — Four Lessons
Length beats complexity
Every added character multiplies the search space. A 16-char lowercase passphrase (~75 bits) outlives an 8-char "complex" password (~52 bits) by millions of times. Complexity rules mostly force humans into predictable patterns (Capital + word + digit + !).
What salts do
A salt is a random value stored beside the hash: hash(salt + password). It kills precomputed rainbow tables and forces every hash to be cracked individually — two users with the same password get different hashes. Salts are not secret; they just make attacks expensive per-user instead of free-for-all.
Why reuse kills you
Your password's strength doesn't matter if it's already in a breach dump. Attackers take leaked email:password pairs and replay them everywhere (credential stuffing). One weak site falls, every account sharing that password falls — the strongest password in the world is worthless the second time you use it.
Slow hashes save lives
MD5/SHA1 are built for speed — terrible for passwords. bcrypt, scrypt, and Argon2 are deliberately slow and memory-hungry. Same password, two realities: MD5 falls at 10 billion guesses/second; bcrypt at 100 thousand. That's a 100,000× tax on the attacker, for free.