Shreya got a call from her bank at 7 AM. "Ma'am, there have been 3 failed login attempts on your net banking account." Her password was "Shreya2001" — her name and birth year. She had been using it for 11 accounts. She changed all of them that morning. The process took 3 hours and 20 minutes because she had never thought about this before.
Indians are among the most targeted users for credential stuffing attacks — because we reuse simple passwords across Gmail, HDFC net banking, Instagram, and company VPN. One leak compromises everything.
Why Indians Are Easy Targets
Most common passwords in India:
- Names + birth year — "Rahul1995", "Priya2000"
- "123456" and "password" — still top 10 globally
- "India@123" — meets bank rules but easily guessed
- Same password for all 15 accounts — one breach, total loss
What Makes a Password Strong?
- Length — minimum 12 characters, ideally 16+
- Mix — uppercase, lowercase, numbers, symbols
- No personal info — no name, birthday, phone number, city
- Unique per account — different password for every site
Worst Passwords Indians Use (And Why They Fail)
"Shreya2001" — cracked in seconds by dictionary attack combining common names + years.
"India@123" — meets HDFC/SBI complexity rules but appears in every leaked password database.
Phone number as password — publicly available on Truecaller. Never.
Passphrases vs Random Passwords
Random passwords (16+ mixed characters) are best for website logins stored in a password manager. Passphrases (4+ random words like river-canvas-bright-forest) are easier to remember and type — ideal for master passwords and WiFi. Use our Password Generator — switch to Passphrase mode for word-based passwords, or Password mode for random strings.
Read more in our passphrase generator guide.
What the Strength Meter Measures
The built-in strength meter uses zxcvbn — the same approach used by Dropbox and other security-focused products. It checks against common password lists, keyboard patterns, names, and dictionary words — not just character count. A long password like passwordpassword scores poorly; a shorter random mix scores higher.
Why Exclude Ambiguous Characters?
Characters like 0, O, l, 1, and I look nearly identical in many fonts. Excluding them reduces transcription errors when you read a password from screen to paper, or share a WiFi password verbally. Enable "Exclude ambiguous characters" in the generator when typing accuracy matters.
How to Create a Password You Can Remember
Passphrase Method
Pick 4 random words + number + symbol: "MyDogLovesBiryani@2025!"
Easy to remember, hard to crack. 28 characters. Meets every bank and corporate policy.
Password Manager Recommendation
Use Bitwarden (free) or Google Password Manager. Store unique 16-character passwords for every account. Remember one master password only. Never write passwords in Notes app or WhatsApp chat.
Check If Your Password Was Leaked
Visit haveibeenpwned.com — enter your email. If your accounts appear in known breaches, change those passwords immediately. Enable 2FA on Gmail, net banking, and social media.
Generate strong passwords instantly with our Password Generator — includes passphrase generator and password strength checker powered by zxcvbn. Secure your WiFi with a QR code using QR Code Generator.