Password security analyser
🛡️ Password security analyser
Powered by Black Swan Cyber Security Solutions
🔒 Your password is analyzed locally and never transmitted
Enter a password to begin breach analysis
Good password requirements:
Need help securing your organisation? Contact Black Swan Cyber Security Solutions on hello@blackswancyber.co.uk or 01246927142
A strong password is useful. A managed password process is better.
This free password analyser helps you check whether a password looks weak, predictable or risky. It is a helpful starting point, but business password security is about more than choosing one stronger password.
Most problems come from reused passwords, shared logins, browser-saved passwords, old staff access and passwords being sent through email, Teams, WhatsApp or spreadsheets.
Weak passwords are easy to guess
Names, dates, pets, football teams, company names and simple patterns can all make passwords easier to crack or guess.
Reused passwords spread the risk
If the same password is used across several accounts, one breach can give criminals a way to try other services.
Shared passwords are hard to control
When passwords are copied into messages or spreadsheets, it becomes difficult to know who has access and who should not.
Need password protection for your business?
Black Swan Cyber Security Solutions helps businesses across Chesterfield, Derbyshire, Sheffield, South Yorkshire, Yorkshire and the wider UK improve password security using practical controls, MFA and Keeper Password Manager.
What good password protection looks like
Use long, unique passwords
- Use a different password for every important account.
- Use longer passwords or passphrases where possible.
- Avoid personal details, company names and obvious patterns.
Use MFA on key accounts
- Protect email, finance, admin and cloud accounts with MFA.
- Use authenticator apps or security keys where practical.
- Avoid relying on passwords alone for critical systems.
Use a business password manager
- Store passwords in encrypted vaults.
- Share access without sending passwords in plain text.
- Remove access properly when people leave or change roles.
Why are weak passwords such a common business risk?
People are expected to remember too many logins. That leads to shortcuts: simple passwords, reused passwords, browser-saved passwords and shared spreadsheets. The issue is not usually carelessness. It is usually lack of a better system.
What is credential stuffing?
Credential stuffing is when criminals use usernames and passwords exposed in previous breaches and try them on other websites or services. Reused passwords make this much more dangerous.
What is a brute force attack?
A brute force attack is when software tries many possible password combinations until one works. Longer, less predictable passwords are much harder to crack than short or common ones.
What is social engineering?
Social engineering is when criminals trick people into revealing information or taking an action. That can include phishing emails, fake login pages, phone calls pretending to be IT support, or messages that create urgency.
Does a password manager replace MFA?
No. A password manager and MFA work best together. The password manager helps create, store and share strong passwords. MFA adds another check so a stolen password alone is less likely to be enough.
What should a business password policy include?
- Unique passwords for every important account.
- MFA for email, finance, admin and remote access.
- A business password manager for storing and sharing credentials.
- A clear joiner, mover and leaver process.
- Regular checks for exposed or unused accounts.
- Staff training on phishing and fake login pages.
How does this link to Cyber Essentials?
Cyber Essentials includes requirements around secure configuration, access control, malware protection, security updates and user access. Passwords and MFA sit within that wider access control picture. If you are working towards Cyber Essentials, password management is a sensible place to start.
What should we do if we think a password has been compromised?
- Change the password immediately.
- Check whether the same password was used elsewhere.
- Review recent sign-in activity where available.
- Enable or reset MFA if needed.
- Remove any suspicious forwarding rules, sessions or connected apps.
- Get help quickly if the account protects email, finance, client data or admin access.
Did you know? 81% of data breaches involve weak or stolen passwords. For UK businesses, this represents a critical vulnerability that can lead to devastating consequences – from ICO fines reaching £17.5 million to complete business disruption.
Recent UK cyber threat statistics:
- 50% of UK businesses experienced a cyber attack in 2024
- Average cost of a data breach in the UK: £3.5 million
- 74% of breaches involve human error, often password-related
- Small businesses face closure within 6 months of a major cyber incident
The true cost of weak passwords
Financial impact
When passwords fail, the consequences extend far beyond the initial breach:
Direct costs:
- ICO fines: Up to £17.5M or 4% of annual turnover under UK GDPR
- Legal fees: Average £150,000-£500,000 for breach response
- System recovery: £50,000-£200,000 for forensic investigation and remediation
- Business interruption: Lost revenue during downtime
Hidden costs:
- Reputation damage: 65% of customers lose trust after a data breach
- Customer churn: Average 31% customer loss following a security incident
- Regulatory scrutiny: Ongoing compliance monitoring and reporting
- Insurance premiums: Significant increases in cyber insurance costs
Understanding password vulnerabilities
Common Attack Methods
1. Credential stuffing Cyber criminals use automated tools to test billions of stolen username/password combinations across multiple sites. If you reuse passwords, a breach at one service compromises all your accounts.
2. Brute force attacks Modern computers can test millions of password combinations per second. A simple 8-character password can be cracked in under 8 hours.
3. Social sngineering Attackers manipulate employees into revealing passwords through:
- Phishing emails mimicking legitimate services
- Phone calls impersonating IT support
- Physical shoulder surfing in offices & public places
4. Data breaches Over 15 billion credentials are available on the dark web from previous breaches. Our tool checks if your password appears in these databases.
The psychology of poor password choices
Why people choose weak passwords:
- Convenience: Easy to remember and type
- Overconfidence: “Nobody would target my small business”
- Password fatigue: Managing dozens of different accounts
- Lack of awareness: Not understanding modern attack capabilities
The anatomy of a strong password
Essential elements:
- Length: Minimum 12 characters (16+ recommended)
- Complexity: Mix of uppercase, lowercase, numbers, and symbols
- Unpredictability: Avoid single dictionary words, personal information, and patterns
- Uniqueness: Different password for every account
Advanced password strategies
Passphrase method: Instead of complex passwords, use memorable phrases:
- Weak:
P@ssw0rd123 - Strong:
Coffee#Loves$Morning!Sunshine2025
Character substitution: Replace letters with numbers and symbols systematically:
MyCompanyIsSecure!becomesMy(0mp@nyIzS3cur3!
Multi-Factor Authentication
Even the strongest password isn’t enough. Multi-Factor Authentication (MFA) blocks 99.9% of automated attacks.
MFA options
Authenticator apps (Recommended):
- Microsoft Authenticator
- Google Authenticator
- Authy
Hardware security keys:
- YubiKey (FIDO2 compliant)
- Google Titan Security Keys
- Ideal for high-privilege accounts
SMS/Voice (Use with Caution):
- Better than no MFA
- Vulnerable to SIM swapping attacks
- Not recommended for critical business accounts
UK compliance and legal requirements
Data Protection Act 2018 & UK GDPR
Security obligations:
- Implement “appropriate technical and organisational measures”
- Ensure confidentiality, integrity, and availability of personal data
- Regular testing and evaluation of security effectiveness
Breach notification requirements:
- Report to ICO within 72 hours of becoming aware
- Notify individuals if high risk to their rights and freedoms
- Maintain detailed records of all processing activities
Sector-specific guidance
Financial services (FCA):
- Strong customer authentication requirements
- Enhanced due diligence for high-risk transactions
- Regular penetration testing and vulnerability assessments
Healthcare (NHS Digital):
- Data Security and Protection Toolkit compliance
- Technical security standards for patient data
- Cyber Essentials certification requirements
Education (DfE):
- Safeguarding requirements for pupil data
- Cyber security guidance for schools
- Regular staff training and awareness programs
Creating a password security culture
Employee training programs
Essential training topics:
- Password creation: Hands-on workshops with real examples
- Phishing recognition: Interactive simulations and testing
- Incident reporting: Clear procedures for suspected breaches
- Mobile security: BYOD policies and app management
Ongoing awareness:
- Monthly security newsletters with current threats
- Quarterly phishing simulations and feedback
- Annual security assessments and policy updates
- Reward programs for security-conscious behaviour
Policy development
Key policy elements:
- Password requirements: Minimum standards and complexity rules
- Account management: Provisioning, de-provisioning, and regular reviews
- Incident response: Clear escalation procedures and communication plans
- Regular audits: Quarterly reviews of access rights and password policies
Responding to password-related incidents
Immediate response steps
If you suspect compromise:
- Isolate: Disconnect affected systems from the network
- Assess: Determine scope and potential data exposure
- Contain: Change all potentially affected passwords
- Document: Maintain detailed logs for regulatory reporting
UK-specific breach response
Legal obligations:
- ICO notification within 72 hours
- Individual notification if high risk
- Cooperation with regulatory investigations
- Implementation of additional security measures
Industry-leading password security services
Black Swan Cyber Security Solutions
As recognised cybersecurity experts serving UK organisations, we provide comprehensive password security services:
Security Assessments:
- Password policy reviews and gap analysis
- Dark web monitoring for credential exposure
- Penetration testing and vulnerability assessments
- Compliance audits and regulatory guidance
Implementation services:
- Enterprise password manager deployment
- Multi-factor authentication rollouts
Training and awareness:
- Executive cyber security briefings
- Staff security awareness programs
- Phishing simulation and response training
- Incident response plan development
Ongoing support:
- 24/7 security monitoring and alerting
- Regular security updates and patch management
- Quarterly security reviews and improvements
- Annual penetration testing and assessment
Password security isn’t just about technology, it’s about protecting your business, customers, and reputation.
Use our free password analyser above to assess your current security posture, then contact Black Swan Cyber Security Solutions for a comprehensive security evaluation.
Don’t wait for a breach to take action. The cost of prevention is always less than the cost of recovery.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!