What’s the cleverest password trick?

The summer after the Second World War, the physicist Richard Feynman needed a document from the atomic-bomb project at Los Alamos, and the library was closed. His friend Frederic de Hoffmann kept a copy of every document in nine locked filing cabinets, so Feynman tried to open them the way the safecracking books said to. On the secretary’s desk he found a sheet with “pi = 3.14159” written across the top, but 31-41-59 didn’t work. So he guessed at the man instead: de Hoffmann, he thought, was “just the kind of guy to use a mathematical constant for a safe combination.” He tried 27-18-28, from e, the constant that begins 2.71828, and the cabinet opened. So did the next one, and one in the next room.

Clever choices tend to be clever in the same way. In a 2006 study at Carnegie Mellon, researchers asked some people to make a password from a memorable phrase, one character per word, a trick still widely recommended. Most borrowed phrases from songs, films, and books. iwtbotaiwtwot was the opening of Dickens’s A Tale of Two Cities (“It was the best of times, it was the worst of times”), SWMtM$$!! was “Show me the money!” from Jerry Maguire, and two people used the Oscar Mayer wiener jingle. The trick helped, for now: the researchers’ dictionary of phrases cracked fewer of these passwords than a standard word list cracked of everyone else’s.

Even a password that looks random can belong to a crowd. In 2019 an engineer, Robert Ou, pointed out that ji32k7au4a83 had been seen more than a hundred times on Have I Been Pwned, a site that collects leaked passwords. Typed on the Zhuyin keyboard most people use in Taiwan, it spells “my password” in Mandarin. Its users may be in on the joke, as with an old one that has circulated online for years: set your password to incorrect, so that when you forget it, the computer tells you.