How should I choose a password?

Table of Contents

Choosing a password

 Choosing a password

Passwords are an important part of computer security. Your passwords should be changed regularly to protect you from identity theft and prevent unauthorized use of your personal information. You can see information on choosing a new Onyen password at the [ https://onyen.unc.edu/cgi-bin/unc_id/services ] Onyen services page .

Because your password is your first line of defense against attack, it is imperative that you choose a strong password that cannot be easily cracked. This is especially important for administrator-level accounts. The System Administration, Network, and Security (SANS) Institute recommends certain guidelines for choosing an effective password.

  • Many computers set an eight-character minimum for your password length. Even if yours doesn't it's good to meet this recommendation. The longer your password, the more secure it will be.

  • Always use a combination of upper- and lower-case letters and include special characters such as '~!@#$%^&*()-_=+{[]}\|`";:,/?.

  • Do not base your password on any items of personal information (e.g. PID, Social Security number, street address, birthdays, names of family members, etc.).

  • Do not attempt substitutions of numbers or characters that look like the letter they replace (e.g. C@R0L!N@ for CAROLINA); sophisticated password-cracking programs try these combinations as well.

  • For stronger passwords, avoid words or combinations of words that could be found in an English dictionary, such as "ChapelHill".

  • For best passwords, experts recommend acronyms for unusual phrases that you invent. An example would be the password "~2myuT$!" for "About 2 more years until Tenure $alary!"

  • Change your password often, and do not write it down anywhere close to your computer.

Do not share passwords with anyone. All passwords should be treated as sensitive, confidential information.

Here are some don'ts :

  • Don't reveal a password over the phone to ANYONE, including computer support personnel. Support personnel should never initiate a call requesting a password.

  • Don't reveal a password in an email message.

  • Don't reveal or talk about a password to anyone, including co-workers or family members.

  • Don't hint at the format of a password (e.g. "my favorite pet.")

  • Don't reveal a password on questionnaires or security forms.

  • Don't use the "Remember Password" feature of applications (e.g. Mozilla Firefox, Mozilla Thunderbird, Internet Explorer, or Outlook).

For additional information about this and other security issues, please visit http://www.unc.edu/security/.

Copyright 2002-2007 The University of North Carolina at Chapel Hill.

Creative Commons License
This work is licensed under a Creative Commons Attribution 3.0 United States License.

Post a Comment

This form is for document feedback. If you need technical assistance, and are affiliated with UNC-Chapel Hill, please Submit a Help Request
Optional
Optional
So that we may contact you.
Do not fill out this form, this is a spam trap.
Top
University of North Carolina - Chapel Hill