Tips for strong passwords
- Use three random words, such as kettle-orbit-pebble. They're long, easy to remember and hard to guess.
- Use a different password for every account, and a password manager to remember them.
- Turn on multi-factor authentication (MFA) wherever it's offered, especially for email and cloud services. Cyber Essentials requires it for cloud services where it's available.
- Don't change passwords on a schedule. Change one when you think it's been exposed.
How we check
Strength is worked out in your browser by looking at length, the mix of characters and common patterns such as words, years and keyboard runs. The breach check uses the Pwned Passwords service in a way that keeps your password private: your browser turns it into a code (a SHA-1 hash) and sends only the first 5 characters of that code. The service sends back hundreds of matching codes and your browser compares them, so neither we nor the service ever see your password. Don't test passwords you use for sensitive systems on any website, including this one. The Cyber Essentials rules come from the NCSC's requirements for IT infrastructure (v3.3). See also the NCSC's three random words advice.
Guidance only. Please read before using this tool. Our tools are free, general guidance to help you prepare. They are not an assessment, a pre-check, or advice on your organisation, and a result here does not mean you will pass Cyber Essentials. The tools help you check parts of your setup, but they don’t do everything for you: they can’t put policies, processes and procedures in place, or show how your controls meet each requirement. The NCSC requirements and IASME’s marking guidance change frequently, and our tools are not updated in line with every change, so they may be incomplete, out of date or wrong. Your organisation is responsible for its own answers, for its controls, and for checking them against the current requirements. Only the assessor who marks your submission decides whether it passes. As far as the law allows, Get Cyber Certified accepts no liability for any loss, failed assessment or other outcome arising from using these tools. By using this tool you agree to our free tools terms.