Start quoting

Two minutes. No spare SIM, no Meta account.

At least 12 characters — and what else we check
  • At least 12 charactersLength beats complexity. Every extra character multiplies the work for anyone guessing, and it is the one thing that scales.
  • Anything you can type — spaces, punctuation, emoji, other alphabetsNothing is stripped or rejected. Four unrelated words with spaces between them is easier to remember and harder to crack than one mangled word.
  • No mix of capitals, numbers and symbols requiredForcing that produces Password1! and Tradie2026!. The pattern is so predictable it makes passwords easier to guess, which is why the requirement was dropped from the standard.
  • Never one that has appeared in a data breachThis is the one that matters most. Attackers try known passwords first — they do not brute-force. Checked against Have I Been Pwned without your password ever leaving this site.
  • Nothing built from your name, email or businessThose are the first things tried by anyone targeting you specifically, rather than everybody at once.
  • You will never be asked to change it on a scheduleRoutine expiry makes people iterate — Winter1, Winter2 — and end up weaker. Change it when there is a reason to.

Already signed up? Sign in  ·  Back to the site