Password strength (English Wikipedia)

Alroomi, Suood; Li, Frank (2023). Measuring Website Password Creation Policies At Scale. Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery. pp. 3108–3122. arXiv:2309.03384. doi:10.1145/3576915.3623156. ISBN 9798400700507.

bbc.com (Global: 20^th place; English: 30^th place)

"Millions using 123456 as password, security study finds". BBC News. 21 April 2019. Archived from the original on 26 April 2025. Retrieved 24 April 2019.

beinternetawesome.withgoogle.com (Global: low place; English: low place)

"Play Interland - Be Internet Awesome". Play Interland - Be Internet Awesome. Retrieved 2024-09-10.

berkeley.edu (Global: 580^th place; English: 462^nd place)

www2.eecs.berkeley.edu

"The Emperor's New Password Manager: Security Analysis of Web-based Password Managers | EECS at UC Berkeley". www2.eecs.berkeley.edu. Retrieved 2023-10-01.

bitwarden.com (Global: low place; English: low place)

"The State of Password Security 2023 Report | Bitwarden Resources". Bitwarden. Archived from the original on 2023-10-11. Retrieved 2023-09-24.

cesg.gov.uk (Global: low place; English: low place)

"The problems with forcing regular password expiry". IA Matters. CESG: the Information Security Arm of GCHQ. 15 April 2016. Archived from the original on 17 August 2016. Retrieved 5 Aug 2016.

changingminds.org (Global: low place; English: low place)

Remembering Passwords (ChangingMinds.org) Archived 2010-01-21 at Wikiwix, as accessed January 19, 2010

cisa.gov (Global: low place; English: low place)

"Choosing and Protecting Passwords". US Cybersecurity & Infrastructure Security Agency (CISA). 2019-11-18. Retrieved 2023-10-10.

cmu.edu (Global: 1,564^th place; English: 1,028^th place)

cups.cs.cmu.edu

"CyLab Usable Privacy and Security Laboratory (CUPS)". Carnegie Mellon University (USA). Retrieved 17 May 2021.

andrew.cmu.edu

"Practical Recommendations for Stronger, More Usable Passwords Combining Minimum-strength, Minimum-length, and Blocklist Requirements" (PDF). Carnegie Mellon University. Retrieved 17 May 2021.

distributed.net (Global: low place; English: low place)

stats.distributed.net

"64-bit key project status". Distributed.net. Archived from the original on September 10, 2013. Retrieved March 27, 2008.
"72-bit key project status". Distributed.net. Archived from the original on October 9, 2018. Retrieved October 12, 2011.

doi.org (Global: 2^nd place; English: 2^nd place)

Florencio, Dinei; Herley, Cormac (May 8, 2007). "A large-scale study of web password habits" (PDF). Proceedings of the 16th international conference on World Wide Web. p. 657. doi:10.1145/1242572.1242661. ISBN 9781595936547. S2CID 10648989. Archived (PDF) from the original on March 27, 2015.
Norman, Donald (2009-11-01). "When Security Gets in the Way". ACM Interactions. 16 (6): 60–63. doi:10.1145/1620693.1620708. Passwords illustrate several of the difficulties with current methods of enforcing security. Passwords are the least expensive mechanism known for securing systems. But onerous password requirements reduce security and increase costs. They reduce security because many people either use trivial algorithms to generate memorable passwords or write down their passwords and store them in easily discoverable places. They increase costs because help desks must be staffed to handle the large number of users who have forgotten their passwords and can no longer log in. These requirements keep out the good guys without deterring the bad guys.
Grassi, Paul A.; Fenton, James L.; Newton, Elaine M.; Perlner, Ray A.; Regenscheid, Andrew R.; Burr, William E.; Richer, Justin P.; Lefkovitz, Naomi B.; Danker, Jamie M.; Choong, Yee-Yin; Greene, Kristen K.; Theofanos, Mary F. (2017). "Special Publication 800-63B - Digital Identity Guidelines". National Institute for Standards and Technology. doi:10.6028/NIST.SP.800-63b. Archived from the original on 21 April 2017. Retrieved 17 May 2021.
Randomness Requirements for Security. doi:10.17487/RFC4086. RFC 4086.
Alroomi, Suood; Li, Frank (2023). Measuring Website Password Creation Policies At Scale. Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery. pp. 3108–3122. arXiv:2309.03384. doi:10.1145/3576915.3623156. ISBN 9798400700507.
William, Cheswick (2012-12-31). "ACM Digital Library - Rethinking Passwords". ACM Queue. 10 (12): 50–56. doi:10.1145/2405116.2422416.
Cipresso, P; Gaggioli, A; Serino, S; Cipresso, S; Riva, G (2012). "How to Create Memorizable and Strong Passwords". J Med Internet Res. 14 (1): e10. doi:10.2196/jmir.1906. PMC 3846346. PMID 22233980.
Brumen, B; Heričko, M; Rozman, I; Hölbl, M (2013). "Security analysis and improvements to the PsychoPass method". J Med Internet Res. 15 (8): e161. doi:10.2196/jmir.2366. PMC 3742392. PMID 23942458.

dropbox.com (Global: 1,209^th place; English: 689^th place)

blogs.dropbox.com

"zxcvbn: realistic password strength estimation". Dropbox Tech Blog. Archived from the original on 2015-04-05.

eff.org (Global: 3,285^th place; English: 2,156^th place)

w2.eff.org

"EFF DES Cracker machine brings honesty to crypto debate". EFF. Archived from the original on January 1, 2010. Retrieved March 27, 2008.

elcomsoft.com (Global: low place; English: low place)

Elcomsoft.com Archived 2006-10-17 at the Wayback Machine, ElcomSoft Password Recovery Speed table, NTLM passwords, Nvidia Tesla S1070 GPU, accessed 2011-02-01
Elcomsoft Wireless Security Auditor, HD5970 GPU Archived 2011-02-19 at the Wayback Machine accessed 2011-02-11

espacenet.com (Global: 800^th place; English: 676^th place)

worldwide.espacenet.com

US patent 7929707, Andrey V. Belenko, "Use of graphics processors as parallel math co-processors for password recovery", issued 2011-04-19, assigned to Elcomsoft Co. Ltd.

ethz.ch (Global: 2,224^th place; English: 1,900^th place)

isiweb.ee.ethz.ch

James Massey (1994). "Guessing and entropy" (PDF). Proceedings of 1994 IEEE International Symposium on Information Theory. IEEE. p. 204. Archived (PDF) from the original on 2014-01-01. Retrieved 2019-07-12.

facebook.com (Global: 77^th place; English: 111^th place)

"Login and Password Help". FaceBook Inc. Archived from the original on 17 May 2021. Retrieved 17 May 2021.

gatech.edu (Global: 4,448^th place; English: 2,923^rd place)

gtri.gatech.edu

"Teraflop Troubles: The Power of Graphics Processing Units May Threaten the World's Password Security System". Georgia Tech Research Institute. Archived from the original on 2010-12-30. Retrieved 2010-11-07.

google.com (Global: 163^rd place; English: 185^th place)

Google, Inc., How safe is your password? Archived 2008-02-22 at the Wayback Machine

hardwaresecrets.com (Global: low place; English: low place)

e.g. for a keyboard with only 17 nonalphanumeric characters, see one for a BlackBerry phone in an enlarged image Archived 2011-04-06 at the Wayback Machine in support of Sandy Berger, BlackBerry Tour 9630 (Verizon) Cell Phone Review, in Hardware Secrets (August 31, 2009) Archived April 6, 2011, at the Wayback Machine, both as accessed January 19, 2010. That some websites don’t allow nonalphanumerics is indicated by Kanhef, Idiots, For Different Reasons (June 30, 2009) (topic post) Archived April 6, 2011, at the Wayback Machine, as accessed January 20, 2010.

ico.org.uk (Global: low place; English: low place)

"Passwords in online services". UK Information Commissioner's Office (ICO). Archived from the original on 4 May 2021. Retrieved 17 May 2021.

ietf.org (Global: 214^th place; English: 176^th place)

datatracker.ietf.org

Randomness Requirements for Security. doi:10.17487/RFC4086. RFC 4086.

iheart.com (Global: 2,030^th place; English: 1,178^th place)

Dave Basner (8 March 2019). "Here's Why 'ji32k7au4a83' Is A Surprisingly Common Password". Archived from the original on 25 March 2019. Retrieved 25 March 2019.

indevis.de (Global: low place; English: low place)

A. Allan. "Passwords are Near the Breaking Point" (PDF). Gartner. Archived from the original (PDF) on April 27, 2006. Retrieved April 10, 2008.

internetsociety.org (Global: low place; English: low place)

Johannes Kiesel; Benno Stein; Stefan Lucks (2017). "A Large-scale Analysis of the Mnemonic Password Advice" (PDF). Proceedings of the 24th Annual Network and Distributed System Security Symposium (NDSS 17). Internet Society. Archived from the original (PDF) on 2017-03-30. Retrieved 2017-03-30.

iupui.edu (Global: 9,528^th place; English: 6,597^th place)

uc.iupui.edu

Mnemonic Devices (Indianapolis, Ind.: Bepko Learning Ctr., University College), as accessed January 19, 2010 Archived June 10, 2010, at the Wayback Machine

lopsa.org (Global: low place; English: low place)

"In Defense of Password Expiration". League of Professional Systems Administrators. Archived from the original on October 12, 2008. Retrieved April 14, 2008.

microsoft.com (Global: 153^rd place; English: 151^st place)

research.microsoft.com

Florencio, Dinei; Herley, Cormac (May 8, 2007). "A large-scale study of web password habits" (PDF). Proceedings of the 16th international conference on World Wide Web. p. 657. doi:10.1145/1242572.1242661. ISBN 9781595936547. S2CID 10648989. Archived (PDF) from the original on March 27, 2015.

microsoft.com

Microsoft Corporation, Strong passwords: How to create and use them Archived 2008-01-01 at the Wayback Machine

docs.microsoft.com

"Security baseline (FINAL) for Windows 10 v1903 and Windows Server v1903". Microsoft. 23 May 2019. Archived from the original on 17 May 2021. Retrieved 17 May 2021.

nbcnews.com (Global: 137^th place; English: 101^st place)

"Want to deter hackers? Make your password longer". NBC News. 2010-08-19. Archived from the original on July 11, 2013. Retrieved 2010-11-07.

ncsc.gov.uk (Global: low place; English: low place)

"Password Policy - Updating your approach". UK National Cyber Security Centre. Archived from the original on 17 May 2021. Retrieved 17 May 2021.
"Password administration for system owners". UK National Cyber Security Centre. Archived from the original on 17 May 2021. Retrieved 17 May 2021.
"What does the NCSC think of password managers?". www.ncsc.gov.uk. Archived from the original on 2019-03-05.

nih.gov (Global: 4^th place; English: 4^th place)

ncbi.nlm.nih.gov

Cipresso, P; Gaggioli, A; Serino, S; Cipresso, S; Riva, G (2012). "How to Create Memorizable and Strong Passwords". J Med Internet Res. 14 (1): e10. doi:10.2196/jmir.1906. PMC 3846346. PMID 22233980.
Brumen, B; Heričko, M; Rozman, I; Hölbl, M (2013). "Security analysis and improvements to the PsychoPass method". J Med Internet Res. 15 (8): e161. doi:10.2196/jmir.2366. PMC 3742392. PMID 23942458.

pubmed.ncbi.nlm.nih.gov

Cipresso, P; Gaggioli, A; Serino, S; Cipresso, S; Riva, G (2012). "How to Create Memorizable and Strong Passwords". J Med Internet Res. 14 (1): e10. doi:10.2196/jmir.1906. PMC 3846346. PMID 22233980.
Brumen, B; Heričko, M; Rozman, I; Hölbl, M (2013). "Security analysis and improvements to the PsychoPass method". J Med Internet Res. 15 (8): e161. doi:10.2196/jmir.2366. PMC 3742392. PMID 23942458.

nist.gov (Global: 355^th place; English: 454^th place)

pages.nist.gov

"SP 800-63-3 – Digital Identity Guidelines" (PDF). NIST. June 2017. Archived from the original on August 6, 2017. Retrieved August 6, 2017.
Grassi, Paul A.; Fenton, James L.; Newton, Elaine M.; Perlner, Ray A.; Regenscheid, Andrew R.; Burr, William E.; Richer, Justin P.; Lefkovitz, Naomi B.; Danker, Jamie M.; Choong, Yee-Yin; Greene, Kristen K.; Theofanos, Mary F. (2017). "Special Publication 800-63B - Digital Identity Guidelines". National Institute for Standards and Technology. doi:10.6028/NIST.SP.800-63b. Archived from the original on 21 April 2017. Retrieved 17 May 2021.

csrc.nist.gov

"SP 800-63 – Electronic Authentication Guideline" (PDF). NIST. Archived from the original (PDF) on July 12, 2004. Retrieved April 20, 2014.

publishing.service.gov.uk (Global: 1,877^th place; English: 1,129^th place)

assets.publishing.service.gov.uk

"Password guidance" (PDF). Cyber Security, UK Government Communications Headquarters. Archived (PDF) from the original on 17 May 2021. Retrieved 17 May 2021.

purdue.edu (Global: 850^th place; English: 625^th place)

cerias.purdue.edu

Eugene Spafford. "Security Myths and Passwords". The Center for Education and Research in Information Assurance and Security. Archived from the original on April 11, 2008. Retrieved April 14, 2008.

reusablesec.blogspot.com (Global: low place; English: low place)

Matt Weir; Susdhir Aggarwal; Michael Collins; Henry Stern (7 October 2010). "Testing Metrics for Password Creation Policies by Attacking Large Sets of Revealed Passwords" (PDF). Archived from the original on July 6, 2012. Retrieved March 21, 2012.

rfc-editor.org (Global: 6,184^th place; English: 4,465^th place)

Randomness Requirements for Security. doi:10.17487/RFC4086. RFC 4086.

schneier.com (Global: 8,888^th place; English: 6,276^th place)

Bruce Schneier (17 June 2005). "Schneier on Security". Write Down Your Password. Archived from the original on April 13, 2008. Retrieved April 10, 2008.
Bruce Schneier. "Snakeoil: Warning Sign #5: Ridiculous key lengths". Archived from the original on April 18, 2008. Retrieved March 27, 2008.
Bruce Schneier, Choosing Secure Passwords Archived 2008-02-23 at the Wayback Machine
Bruce, Schneier (10 October 2017). "Changes in Password Best Practices". Schneier on Security. Archived from the original on 13 May 2021. Retrieved 17 May 2021.

securityweek.com (Global: low place; English: low place)

"Why User Names and Passwords Are Not Enough | SecurityWeek.Com". www.securityweek.com. 31 January 2019. Archived from the original on 2020-12-04. Retrieved 2020-10-31.

semanticscholar.org (Global: 11^th place; English: 8^th place)

api.semanticscholar.org

Florencio, Dinei; Herley, Cormac (May 8, 2007). "A large-scale study of web password habits" (PDF). Proceedings of the 16th international conference on World Wide Web. p. 657. doi:10.1145/1242572.1242661. ISBN 9781595936547. S2CID 10648989. Archived (PDF) from the original on March 27, 2015.

stackoverflow.com (Global: 4,643^rd place; English: 2,973^rd place)

"Quantum Computing and Encryption Breaking". Stack Overflow. 2011-05-27. Archived from the original on 2013-05-21. Retrieved 2013-03-17.

stealthbits.com (Global: low place; English: low place)

"NIST PASSWORD GUIDELINES IN 2020". Stealthbits. 18 August 2020. Archived from the original on 17 May 2021. Retrieved 17 May 2021.

support.google.com (Global: 1,091^st place; English: 936^th place)

"Create a Strong Password". Google Inc. Archived from the original on 17 May 2021. Retrieved 17 May 2021.

tesla.tours (Global: low place; English: low place)

"Password Rules - Founder of Password Complexity Says SORRY!". Archived from the original on 17 May 2021. Retrieved 17 May 2021.
"Bill Burr, Founder of Password complexity rules says SORRY!". Archived from the original on 17 May 2021. Retrieved 17 May 2021.

thehackernews.com (Global: low place; English: low place)

"ComodoHacker responsible for DigiNotar Attack – Hacking News". Thehackernews.com. 2011-09-06. Archived from the original on 2013-05-17. Retrieved 2013-03-17.

theregister.co.uk (Global: 1,216^th place; English: 797^th place)

forums.theregister.co.uk

e.g. for a keyboard with only 17 nonalphanumeric characters, see one for a BlackBerry phone in an enlarged image Archived 2011-04-06 at the Wayback Machine in support of Sandy Berger, BlackBerry Tour 9630 (Verizon) Cell Phone Review, in Hardware Secrets (August 31, 2009) Archived April 6, 2011, at the Wayback Machine, both as accessed January 19, 2010. That some websites don’t allow nonalphanumerics is indicated by Kanhef, Idiots, For Different Reasons (June 30, 2009) (topic post) Archived April 6, 2011, at the Wayback Machine, as accessed January 20, 2010.

umd.edu (Global: 1,747^th place; English: 1,277^th place)

cs.umd.edu

University of Maryland, Choosing a Good Password Archived 2014-06-14 at the Wayback Machine

us-cert.gov (Global: low place; English: low place)

"Cyber Security Tip ST04-002". Choosing and Protecting Passwords. US CERT. 21 May 2009. Archived from the original on July 7, 2009. Retrieved June 20, 2009.

usenix.org (Global: 5,990^th place; English: 3,752^nd place)

Florêncio, Dinei; Herley, Cormac; Coskun, Baris (2007). Do Strong Web Passwords Accomplish Anything? (PDF). 2nd USENIX Workshop on Hot Topics in Security. Boston, Massachusetts.

web.archive.org (Global: 1^st place; English: 1^st place)

"Cyber Security Tip ST04-002". Choosing and Protecting Passwords. US CERT. 21 May 2009. Archived from the original on July 7, 2009. Retrieved June 20, 2009.
"Why User Names and Passwords Are Not Enough | SecurityWeek.Com". www.securityweek.com. 31 January 2019. Archived from the original on 2020-12-04. Retrieved 2020-10-31.
"Millions using 123456 as password, security study finds". BBC News. 21 April 2019. Archived from the original on 26 April 2025. Retrieved 24 April 2019.
"SP 800-63 – Electronic Authentication Guideline" (PDF). NIST. Archived from the original (PDF) on July 12, 2004. Retrieved April 20, 2014.
"Teraflop Troubles: The Power of Graphics Processing Units May Threaten the World's Password Security System". Georgia Tech Research Institute. Archived from the original on 2010-12-30. Retrieved 2010-11-07.
Elcomsoft.com Archived 2006-10-17 at the Wayback Machine, ElcomSoft Password Recovery Speed table, NTLM passwords, Nvidia Tesla S1070 GPU, accessed 2011-02-01
Elcomsoft Wireless Security Auditor, HD5970 GPU Archived 2011-02-19 at the Wayback Machine accessed 2011-02-11
James Massey (1994). "Guessing and entropy" (PDF). Proceedings of 1994 IEEE International Symposium on Information Theory. IEEE. p. 204. Archived (PDF) from the original on 2014-01-01. Retrieved 2019-07-12.
Florencio, Dinei; Herley, Cormac (May 8, 2007). "A large-scale study of web password habits" (PDF). Proceedings of the 16th international conference on World Wide Web. p. 657. doi:10.1145/1242572.1242661. ISBN 9781595936547. S2CID 10648989. Archived (PDF) from the original on March 27, 2015.
Bruce Schneier (December 14, 2006). "MySpace Passwords aren't so Dumb". Wired Magazine. Archived from the original on May 21, 2014. Retrieved April 11, 2008.
Matt Weir; Susdhir Aggarwal; Michael Collins; Henry Stern (7 October 2010). "Testing Metrics for Password Creation Policies by Attacking Large Sets of Revealed Passwords" (PDF). Archived from the original on July 6, 2012. Retrieved March 21, 2012.
"SP 800-63-3 – Digital Identity Guidelines" (PDF). NIST. June 2017. Archived from the original on August 6, 2017. Retrieved August 6, 2017.
A. Allan. "Passwords are Near the Breaking Point" (PDF). Gartner. Archived from the original (PDF) on April 27, 2006. Retrieved April 10, 2008.
Grassi, Paul A.; Fenton, James L.; Newton, Elaine M.; Perlner, Ray A.; Regenscheid, Andrew R.; Burr, William E.; Richer, Justin P.; Lefkovitz, Naomi B.; Danker, Jamie M.; Choong, Yee-Yin; Greene, Kristen K.; Theofanos, Mary F. (2017). "Special Publication 800-63B - Digital Identity Guidelines". National Institute for Standards and Technology. doi:10.6028/NIST.SP.800-63b. Archived from the original on 21 April 2017. Retrieved 17 May 2021.
Bruce Schneier (17 June 2005). "Schneier on Security". Write Down Your Password. Archived from the original on April 13, 2008. Retrieved April 10, 2008.
"Want to deter hackers? Make your password longer". NBC News. 2010-08-19. Archived from the original on July 11, 2013. Retrieved 2010-11-07.
"EFF DES Cracker machine brings honesty to crypto debate". EFF. Archived from the original on January 1, 2010. Retrieved March 27, 2008.
"64-bit key project status". Distributed.net. Archived from the original on September 10, 2013. Retrieved March 27, 2008.
"72-bit key project status". Distributed.net. Archived from the original on October 9, 2018. Retrieved October 12, 2011.
Bruce Schneier. "Snakeoil: Warning Sign #5: Ridiculous key lengths". Archived from the original on April 18, 2008. Retrieved March 27, 2008.
"Quantum Computing and Encryption Breaking". Stack Overflow. 2011-05-27. Archived from the original on 2013-05-21. Retrieved 2013-03-17.
Microsoft Corporation, Strong passwords: How to create and use them Archived 2008-01-01 at the Wayback Machine
Bruce Schneier, Choosing Secure Passwords Archived 2008-02-23 at the Wayback Machine
Google, Inc., How safe is your password? Archived 2008-02-22 at the Wayback Machine
University of Maryland, Choosing a Good Password Archived 2014-06-14 at the Wayback Machine
"NIST PASSWORD GUIDELINES IN 2020". Stealthbits. 18 August 2020. Archived from the original on 17 May 2021. Retrieved 17 May 2021.
"Password Policy - Updating your approach". UK National Cyber Security Centre. Archived from the original on 17 May 2021. Retrieved 17 May 2021.
"Password administration for system owners". UK National Cyber Security Centre. Archived from the original on 17 May 2021. Retrieved 17 May 2021.
"Password Rules - Founder of Password Complexity Says SORRY!". Archived from the original on 17 May 2021. Retrieved 17 May 2021.
Bruce, Schneier (10 October 2017). "Changes in Password Best Practices". Schneier on Security. Archived from the original on 13 May 2021. Retrieved 17 May 2021.
"What does the NCSC think of password managers?". www.ncsc.gov.uk. Archived from the original on 2019-03-05.
e.g. for a keyboard with only 17 nonalphanumeric characters, see one for a BlackBerry phone in an enlarged image Archived 2011-04-06 at the Wayback Machine in support of Sandy Berger, BlackBerry Tour 9630 (Verizon) Cell Phone Review, in Hardware Secrets (August 31, 2009) Archived April 6, 2011, at the Wayback Machine, both as accessed January 19, 2010. That some websites don’t allow nonalphanumerics is indicated by Kanhef, Idiots, For Different Reasons (June 30, 2009) (topic post) Archived April 6, 2011, at the Wayback Machine, as accessed January 20, 2010.
"ComodoHacker responsible for DigiNotar Attack – Hacking News". Thehackernews.com. 2011-09-06. Archived from the original on 2013-05-17. Retrieved 2013-03-17.
Dave Basner (8 March 2019). "Here's Why 'ji32k7au4a83' Is A Surprisingly Common Password". Archived from the original on 25 March 2019. Retrieved 25 March 2019.
"The State of Password Security 2023 Report | Bitwarden Resources". Bitwarden. Archived from the original on 2023-10-11. Retrieved 2023-09-24.
"Bill Burr, Founder of Password complexity rules says SORRY!". Archived from the original on 17 May 2021. Retrieved 17 May 2021.
"Passwords in online services". UK Information Commissioner's Office (ICO). Archived from the original on 4 May 2021. Retrieved 17 May 2021.
"Password guidance" (PDF). Cyber Security, UK Government Communications Headquarters. Archived (PDF) from the original on 17 May 2021. Retrieved 17 May 2021.
"Create a Strong Password". Google Inc. Archived from the original on 17 May 2021. Retrieved 17 May 2021.
"Login and Password Help". FaceBook Inc. Archived from the original on 17 May 2021. Retrieved 17 May 2021.
"Security baseline (FINAL) for Windows 10 v1903 and Windows Server v1903". Microsoft. 23 May 2019. Archived from the original on 17 May 2021. Retrieved 17 May 2021.
"In Defense of Password Expiration". League of Professional Systems Administrators. Archived from the original on October 12, 2008. Retrieved April 14, 2008.
"The problems with forcing regular password expiry". IA Matters. CESG: the Information Security Arm of GCHQ. 15 April 2016. Archived from the original on 17 August 2016. Retrieved 5 Aug 2016.
Eugene Spafford. "Security Myths and Passwords". The Center for Education and Research in Information Assurance and Security. Archived from the original on April 11, 2008. Retrieved April 14, 2008.
Johannes Kiesel; Benno Stein; Stefan Lucks (2017). "A Large-scale Analysis of the Mnemonic Password Advice" (PDF). Proceedings of the 24th Annual Network and Distributed System Security Symposium (NDSS 17). Internet Society. Archived from the original (PDF) on 2017-03-30. Retrieved 2017-03-30.
Mnemonic Devices (Indianapolis, Ind.: Bepko Learning Ctr., University College), as accessed January 19, 2010 Archived June 10, 2010, at the Wayback Machine
"zxcvbn: realistic password strength estimation". Dropbox Tech Blog. Archived from the original on 2015-04-05.

wikiwix.com (Global: 194^th place; English: 643^rd place)

archive.wikiwix.com

Remembering Passwords (ChangingMinds.org) Archived 2010-01-21 at Wikiwix, as accessed January 19, 2010

wired.com (Global: 193^rd place; English: 152^nd place)

archive.wired.com

Bruce Schneier (December 14, 2006). "MySpace Passwords aren't so Dumb". Wired Magazine. Archived from the original on May 21, 2014. Retrieved April 11, 2008.

Password strength (English Wikipedia)

acm.org (Global: 1,185th place; English: 840th place)

queue.acm.org

archive.org (Global: 6th place; English: 6th place)

archive.today (Global: 14th place; English: 14th place)

arxiv.org (Global: 69th place; English: 59th place)

bbc.com (Global: 20th place; English: 30th place)

beinternetawesome.withgoogle.com (Global: low place; English: low place)

berkeley.edu (Global: 580th place; English: 462nd place)

www2.eecs.berkeley.edu

bitwarden.com (Global: low place; English: low place)

cesg.gov.uk (Global: low place; English: low place)

changingminds.org (Global: low place; English: low place)

cisa.gov (Global: low place; English: low place)

cmu.edu (Global: 1,564th place; English: 1,028th place)

cups.cs.cmu.edu

andrew.cmu.edu

distributed.net (Global: low place; English: low place)

stats.distributed.net

doi.org (Global: 2nd place; English: 2nd place)

dropbox.com (Global: 1,209th place; English: 689th place)

blogs.dropbox.com

eff.org (Global: 3,285th place; English: 2,156th place)

w2.eff.org

elcomsoft.com (Global: low place; English: low place)

espacenet.com (Global: 800th place; English: 676th place)

worldwide.espacenet.com

ethz.ch (Global: 2,224th place; English: 1,900th place)

isiweb.ee.ethz.ch

facebook.com (Global: 77th place; English: 111th place)

gatech.edu (Global: 4,448th place; English: 2,923rd place)

gtri.gatech.edu

google.com (Global: 163rd place; English: 185th place)

hardwaresecrets.com (Global: low place; English: low place)

ico.org.uk (Global: low place; English: low place)

ietf.org (Global: 214th place; English: 176th place)

datatracker.ietf.org

iheart.com (Global: 2,030th place; English: 1,178th place)

indevis.de (Global: low place; English: low place)

internetsociety.org (Global: low place; English: low place)

iupui.edu (Global: 9,528th place; English: 6,597th place)

uc.iupui.edu

lopsa.org (Global: low place; English: low place)

microsoft.com (Global: 153rd place; English: 151st place)

research.microsoft.com

microsoft.com

docs.microsoft.com

nbcnews.com (Global: 137th place; English: 101st place)

ncsc.gov.uk (Global: low place; English: low place)

nih.gov (Global: 4th place; English: 4th place)

ncbi.nlm.nih.gov

pubmed.ncbi.nlm.nih.gov

nist.gov (Global: 355th place; English: 454th place)

pages.nist.gov

csrc.nist.gov

publishing.service.gov.uk (Global: 1,877th place; English: 1,129th place)

assets.publishing.service.gov.uk

purdue.edu (Global: 850th place; English: 625th place)

cerias.purdue.edu

reusablesec.blogspot.com (Global: low place; English: low place)

rfc-editor.org (Global: 6,184th place; English: 4,465th place)

schneier.com (Global: 8,888th place; English: 6,276th place)

securityweek.com (Global: low place; English: low place)

semanticscholar.org (Global: 11th place; English: 8th place)

api.semanticscholar.org

stackoverflow.com (Global: 4,643rd place; English: 2,973rd place)

stealthbits.com (Global: low place; English: low place)

support.google.com (Global: 1,091st place; English: 936th place)

tesla.tours (Global: low place; English: low place)

thehackernews.com (Global: low place; English: low place)

theregister.co.uk (Global: 1,216th place; English: 797th place)

forums.theregister.co.uk

umd.edu (Global: 1,747th place; English: 1,277th place)

cs.umd.edu

us-cert.gov (Global: low place; English: low place)

usenix.org (Global: 5,990th place; English: 3,752nd place)

web.archive.org (Global: 1st place; English: 1st place)

wikiwix.com (Global: 194th place; English: 643rd place)

archive.wikiwix.com

wired.com (Global: 193rd place; English: 152nd place)

acm.org (Global: 1,185^th place; English: 840^th place)

archive.org (Global: 6^th place; English: 6^th place)

archive.today (Global: 14^th place; English: 14^th place)

arxiv.org (Global: 69^th place; English: 59^th place)

bbc.com (Global: 20^th place; English: 30^th place)

berkeley.edu (Global: 580^th place; English: 462^nd place)

cmu.edu (Global: 1,564^th place; English: 1,028^th place)

doi.org (Global: 2^nd place; English: 2^nd place)

dropbox.com (Global: 1,209^th place; English: 689^th place)

eff.org (Global: 3,285^th place; English: 2,156^th place)

espacenet.com (Global: 800^th place; English: 676^th place)

ethz.ch (Global: 2,224^th place; English: 1,900^th place)

facebook.com (Global: 77^th place; English: 111^th place)

gatech.edu (Global: 4,448^th place; English: 2,923^rd place)

google.com (Global: 163^rd place; English: 185^th place)

ietf.org (Global: 214^th place; English: 176^th place)

iheart.com (Global: 2,030^th place; English: 1,178^th place)

iupui.edu (Global: 9,528^th place; English: 6,597^th place)

microsoft.com (Global: 153^rd place; English: 151^st place)

nbcnews.com (Global: 137^th place; English: 101^st place)

nih.gov (Global: 4^th place; English: 4^th place)

nist.gov (Global: 355^th place; English: 454^th place)

publishing.service.gov.uk (Global: 1,877^th place; English: 1,129^th place)

purdue.edu (Global: 850^th place; English: 625^th place)

rfc-editor.org (Global: 6,184^th place; English: 4,465^th place)

schneier.com (Global: 8,888^th place; English: 6,276^th place)

semanticscholar.org (Global: 11^th place; English: 8^th place)

stackoverflow.com (Global: 4,643^rd place; English: 2,973^rd place)

support.google.com (Global: 1,091^st place; English: 936^th place)

theregister.co.uk (Global: 1,216^th place; English: 797^th place)

umd.edu (Global: 1,747^th place; English: 1,277^th place)

usenix.org (Global: 5,990^th place; English: 3,752^nd place)

web.archive.org (Global: 1^st place; English: 1^st place)

wikiwix.com (Global: 194^th place; English: 643^rd place)

wired.com (Global: 193^rd place; English: 152^nd place)