Articles about passwords, security, and why almost everything we were taught was wrong.https://password.es/enhttps://password.es/en/blog/what-is-a-password/https://password.es/en/blog/what-is-a-password/The computer password was born in 1961 and the first breach came a year later. Almost everything we were taught about passwords came from a 2003 guess its own author regrets.Fri, 17 Jul 2026 00:00:00 GMTpassword.eshttps://password.es/en/blog/why-password-es-never-sends-your-password/https://password.es/en/blog/why-password-es-never-sends-your-password/A site that asks for your password in order to check it has a trust problem no promise can fix. Our answer isn't a better promise: it's not needing the password at all, and letting you verify that yourself in thirty seconds.Wed, 15 Jul 2026 00:00:00 GMTpassword.eshttps://password.es/en/blog/your-password-manager-vs-your-memory/https://password.es/en/blog/your-password-manager-vs-your-memory/Of every password rule we were taught, only one is still standing: a different one on every site. It is also the only one nobody follows, because with memory alone it is literally impossible.Thu, 02 Jul 2026 00:00:00 GMTpassword.eshttps://password.es/en/blog/passkeys-the-password-that-doesnt-exist/https://password.es/en/blog/passkeys-the-password-that-doesnt-exist/If the trouble with passwords is that there's a shared secret someone else keeps on your behalf, the fix is to get rid of the shared secret. That's what passkeys are — here's what they fix and what they don't.Thu, 18 Jun 2026 00:00:00 GMTpassword.eshttps://password.es/en/blog/security-questions/https://password.es/en/blog/security-questions/Your mother's maiden name isn't a secret, it's a public record. Google analysed hundreds of millions of secret answers and concluded they don't work on their own.Thu, 28 May 2026 00:00:00 GMTpassword.eshttps://password.es/en/blog/2fa-sms-the-worst-of-the-good-options/https://password.es/en/blog/2fa-sms-the-worst-of-the-good-options/A second factor over SMS is far better than no second factor at all and, at the same time, the weakest one there is. The reason isn't cryptographic: it's that somebody at your carrier picks up the phone.Thu, 07 May 2026 00:00:00 GMTpassword.eshttps://password.es/en/blog/what-really-happens-when-your-password-leaks/https://password.es/en/blog/what-really-happens-when-your-password-leaks/A breach doesn't end the day it hits the news — that's where it starts. It gets cracked, cross-referenced with other lists and resold, and all of it works for one reason: we reuse.Thu, 16 Apr 2026 00:00:00 GMTpassword.eshttps://password.es/en/blog/hash-salt-bcrypt-argon2/https://password.es/en/blog/hash-salt-bcrypt-argon2/A well-built site doesn't know your password: it keeps a fingerprint. And the function that computes that fingerprint has to be slow on purpose, because it's the one defence where attacker and defender run exactly the same race.Thu, 26 Mar 2026 00:00:00 GMTpassword.eshttps://password.es/en/blog/how-long-does-your-password-really-take-to-crack/https://password.es/en/blog/how-long-does-your-password-really-take-to-crack/How long a password holds out isn't decided by the password: it's decided by the hash the site stored it with. And nobody mentions that when you sign up.Wed, 04 Mar 2026 00:00:00 GMTpassword.eshttps://password.es/en/blog/diceware-dice-pick-better-passwords-than-you/https://password.es/en/blog/diceware-dice-pick-better-passwords-than-you/In 1995 Arnold Reinhold solved the problem of human randomness with five dice and a list of 7,776 words. Every roll is worth 12.9 bits, and they're 12.9 real ones.Thu, 12 Feb 2026 00:00:00 GMTpassword.eshttps://password.es/en/blog/what-are-entropy-bits/https://password.es/en/blog/what-are-entropy-bits/A strength percentage means nothing. A bit does: every bit doubles the number of guesses someone needs to crack your password. How to read the number the generator shows you, without a single frightening equation.Thu, 22 Jan 2026 00:00:00 GMTpassword.es