Why is password important?

It is critical that you maintain your password appropriately. Remember, in computer security, passwords are always the weakest link!

If your password is compromised, you jeopardize:

Privacy, security and reputation: By intruders gaining access to your email, bank account, and other sensitive information, you could damage not just your own privacy and reputation, but that of the university and the individuals whose data you have access to. Your identity may be stolen. Your email can be used to send defamatory messages or email scams in your name, and your account can be used to host illegal materials. They could also use your account to gain further access into university resources.
Compliance/legal issues: In addition to privacy and reputation, you may be putting the university at risk of being out of compliance with its legal and regulatory obligations and the resulting fines and penalties.

What is a good password?

Passwords should be unique.

Each account of yours should have unique passwords.

Use a unique password for each website. If crooks steal your account information from one site, they'll try to use those credentials on hundreds of other well-known websites, such as banking, social media, or online shopping, hoping you've reused the password elsewhere. That's called a "Credential stuffing attack" and it's extremely common.

DO NOT use your IT Account password for other services (e.g., your bank account, your non-UMass email address, online streaming, online gaming, online shopping). If your account on that service is compromised, someone would also have your UMass account password.

Passwords should be strong.

Generally, the longer and the more “chaotic” the password, the better.

Below are methods to help you create strong passwords.

Create passphrases that are memorable. Refer to the following for an example: xkcd: Password Strength
Don't want to think up your own strong passwords? Use the password manager to generate a password for you.

Google Chrome - Generate a password
Apple Mac - Tips for creating secure passwords on Mac
Apple iPhone - Automatically fill in strong passwords on iPhone
Microsoft Edge - Use Password Generator to create more secure passwords in Microsoft Edge

Use Password card or other similar tools.

Use themes and rules

Choose a theme for all your passwords (e.g., your passwords are always based on your favorite songs or movies). Decide on a few rules that you'll use to construct your passwords. For example:

- Select a song: Romewasn'tbuiltinadaybyMorcheeba.
- Theme: music.
- Rule: Use song name and artist.

Note: Please do not use this example. Hackers often try passwords available in reference materials.

Password Complexity Requirements at UMass Amherst

The following complexity rules are required for all UMass Amherst account passwords.

Must be between 10 and 32 characters.
Cannot be any of your previous 5 passwords.
Cannot be on our list of insecure passwords.
Can be any combination of:
Uppercase characters (A - Z)
Lowercase characters (a - z)
Digits (0 - 9)
Special characters (limited to the following): ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~, space

Did you know?

“My name is not a good password.”

Back in 2017, UMass Amherst IT department co-developed the “My name is not a good password.” campaign with UMass Amherst undergraduate students, aiming to raise awareness of cyber security by focusing on ‘weak passwords’ as the center of the campaign.

The team created a website where students can create posters with pictures of their pets, underneath the tagline “My name is not a good password.” To make the campaign even more interactive, the team created giant photo frames that students could pose with in real life, under the same “My name is not a good password” banner.

Dog Peanut with a speech bubble: My name is Peanut. My name is not a good password.

How often should you update your passwords?

Normally, you are suggested to change your passwords at least twice a year (with daylight savings).

But, if you suspect that your password has been stolen or compromised, change it immediately.

Some examples of that should raise your suspicion of a compromised password, include:

When notified by IT. If you are notified via email or text message, don’t click on the links, as it may be phishing. Instead, follow the steps to change your IT password.
If someone saw you type your password.
If someone saw your password displayed.
If your unencrypted device was lost or stolen. Encrypt your devices, so should they be lost or stolen you don’t need to worry about passwords stored on them. Note: This is already a requirement for university devices.
If any computer you used your account on becomes infected with malware. Malware and other viruses are known for stealing passwords. If you suspect your computer has a virus, do not access any service that requires you to enter a password (e.g., your UMass account , online banking).
If you see strange activity on your account.
If you become aware that your account was phished.