CompTIA Tech+ (FC0-U71): Password Best Practices, Encryption Use Cases and Wi-Fi Security

A strong password is one that an attacker cannot guess or crack in any practical time, and the single biggest factor in that is password length. Password-cracking tools try every combination up to a given length, so each extra character multiplies the work: a long passphrase of several unrelated words is far harder to crack than a short password with a few symbols in it.

Password complexity is the rule that a password must mix character types — uppercase and lowercase letters, numbers and symbols. Complexity enlarges the set of characters an attacker has to try, but it helps much less than people expect when it is applied predictably. Capitalizing the first letter, swapping o for 0 or a for @, and adding a birth year or ! at the end are the exact patterns cracking tools try first.

What makes a password weak

• It is short, even if it uses symbols.
• It contains personal details that can be found online: names, pets, birthdays, favorite teams.
• It is a dictionary word or a common password with a predictable substitution.
• It has been used before — on this site or any other.

The practical rule: make passwords long first, avoid personal and predictable patterns, and use a different one for every account. Current NIST guidance (SP 800-63B-4) takes the same view: it favors length and checks against known-breached passwords, and no longer recommends forced composition rules.

Organizations enforce password best practices with password policy settings, and each setting solves a different problem. Password history remembers a user's recent passwords and rejects a new password that matches one of them, so a user cannot simply switch back to an old favorite. Password expiration sets how long a password stays valid before it must be changed, which limits how long a stolen password keeps working if nobody notices the theft.

History and expiration work together: expiration forces a change, and history makes sure the change is to something new. Lockout is often listed alongside them but is a different control — it reacts to failed sign-in attempts, not to the password itself. Note that current NIST guidance no longer recommends forcing routine password changes on a timer, because users respond with predictable tweaks (Spring2026! becomes Summer2026!); it recommends changing a password when there is evidence it has been compromised. Many organizations still use expiration, so know what it does and why.

Password reuse across sites is dangerous because a breach of one site exposes every account that shares the password. Attackers take username and password lists leaked from one service and automatically try them on email, banking and shopping sites — a technique called credential stuffing. If an online shop is breached and the same password protects the user's bank account, the attacker can now try the bank too, no matter how long or complex that password was. Length, complexity, history and expiration rules on one site cannot stop this; only a different password per site can.

A password manager is an application that stores login details in an encrypted vault, protected by one strong master password (ideally with multifactor authentication on the vault). It solves the memory problem that causes reuse: it can generate a long, random, unique password for every account, store it, and fill it in on the correct site. Because it fills passwords only on the site they were saved for, it also helps resist look-alike phishing sites. The master password becomes the one password the user must remember and must never reuse anywhere.

Password privacy means a password is known only to its owner. Never share it — not with a coworker covering for you, not with someone claiming to be from IT, and not by sticky note, text message or chat. Every account should be used only by its owner so that actions can be traced to the right person (accountability). When someone needs access to the same data or system, the right answer is their own account with the right permissions, arranged through IT. Written lists are unique but readable by anyone who finds them, which is why an encrypted password manager beats a notebook.

A safe password reset process starts by verifying that the person asking is the account owner. A call or message saying "I forgot my password" is a classic social engineering approach, so a help desk technician verifies identity first and only then sets a temporary password or unlocks the account. The temporary password should be single-use, forcing the user to choose a new one at next sign-in.

Self-service reset features follow the same principle. The secure pattern is a reset link sent only to the email address or phone number already on the account, which works once and expires quickly. Weak designs skip that identity check, reveal the existing password (which shows the site stores passwords in readable form), or rely on knowledge-based questions whose answers are often discoverable on social media.

Changing default usernames and passwords

Many devices ship with a default username and password such as admin / admin. Defaults are printed in manuals and widely published online, and many units of the same model may share them, so an unchanged default lets anyone who can reach the device take control of it. Changing the default sign-in is the most important setup step for routers, smart cameras, printers and other internet-connected devices — cosmetic or convenience settings do nothing to close that hole. Some manufacturers now ship a unique password per device, printed on a label; it should still be changed if others could see that label.

Enabling passwords

Enabling passwords means making sure a device actually asks for credentials: a password, PIN or biometric at startup and when it wakes from sleep or the screen lock. A laptop that opens straight to the desktop after sleep is unprotected no matter how strong its password is. Every protection that follows — encryption, lockout, a strong password — depends on the device actually asking for it.

A website certificate is a digital document, issued by a trusted certificate authority (CA), that lets the browser confirm it has reached the site named in the address bar and set up an encrypted HTTPS connection. To issue one, the CA verifies that the requester controls the domain, and for some certificate types also verifies the organization behind it. A valid certificate therefore confirms the site's identity and enables encryption — it does not prove that the owner is honest, the content is accurate, or the site is free of malware. Scammers can obtain valid certificates for their own look-alike domains, so the padlock alone is not proof a site is safe.

A certificate is invalid when it has expired, was issued for a different name than the site you are visiting, comes from an issuer the browser does not trust (including self-signed certificates), or has been revoked. The browser then shows a full-page warning. Any of these can mean the site is not who it claims to be or that someone is intercepting the connection. The safe practice is to leave without signing in or entering data, and reach the organization another way, such as a known bookmark, its official app or a typed address. Nothing done in the browser on your side changes the site's certificate, so a warning cannot be "fixed" by the visitor.

Other safe browsing habits: check the address carefully before signing in, prefer HTTPS sites, keep the browser updated, and be wary of unexpected downloads and pop-ups.

Web browser history and location tracking

Web browser history is a record of the sites a browser has visited, and it works both ways. As an accounting record it shows what was accessed and when, which helps an organization investigate misuse. As a privacy exposure it reveals a user's activity to anyone who uses the same browser profile, along with saved cookies, form entries and sometimes saved passwords. On a shared or public computer, use a private browsing window or clear the history, cookies and saved data, and always sign out. Location tracking is similar: phones, apps and photos record where a device has been, which can confirm where company equipment was used but also reveals a person's routine and home address. Review which apps may use location, turn it off for apps that do not need it, and remove location data from photos before sharing them.

Software piracy

Software piracy is copying, installing or distributing software without a valid license, including "cracked" copies and key generators. It is illegal and breaks the license agreement, which can bring fines for an organization. It is also a security risk: pirated installers are a common way to spread malware, and pirated copies usually cannot receive security updates. Get software only from the publisher or an official app store, and keep track of licenses.

Privacy when using AI tools

AI chatbots and assistants send what you type to the provider, and prompts may be stored, reviewed or used to train future models depending on the service and its settings. Treat a prompt like a message to an outside company: never paste passwords, personal information such as ID or account numbers, health details, or confidential work data, and use only the AI tools your organization has approved for work information. Check the tool's privacy settings and data-retention options. The same thinking applies to social networking, email, file sharing and instant messaging, covered in the Tech+ lesson on security concepts and device security: share the minimum, and assume anything sent can be stored and forwarded.

Encryption turns readable data, called plain text (or plaintext), into scrambled, unreadable data called ciphertext, using an algorithm and a secret value called a key. Decryption uses the correct key to turn ciphertext back into plain text. Without the key, someone who copies an encrypted file — from a stolen USB drive, for example — sees only ciphertext that cannot practically be turned back into the original.

Encryption protects confidentiality. It is applied in two situations: data at rest (stored on a disk, phone, USB drive or server) and data in transit (moving across a network). Each situation needs its own protection — encrypting a file on a laptop does nothing for the copy sent as an email attachment, and encrypting a connection does nothing for the file once it lands on a server.

Data at rest is protected by encrypting either individual files or the whole storage device, and the choice depends on what the threat is. File-level encryption encrypts chosen files or folders — a password-protected document or archive, or an operating-system feature that encrypts a selected folder. Disk-level encryption (full-disk encryption, such as BitLocker on Windows or FileVault on macOS) encrypts the entire drive, including the operating system, temporary files, swap space and anything the user never thought to protect.

That last row matters. Disk-level encryption is transparent: once the system has started and a user has signed in, files are decrypted automatically as they are read. It protects a laptop that is stolen or a drive that is pulled out and connected elsewhere, but it does not protect files from other users of the same running computer, or from malware running under the signed-in user's account — to them the files simply open as plain text. That is why strong passwords and multifactor authentication still matter alongside encryption. A sign-in password on its own is not encryption: without disk encryption, a thief can move the drive to another computer and read it.

Mobile device encryption

Mobile device encryption protects the photos, messages and other data stored on a phone or tablet if it is lost or stolen. Modern iPhones and Android phones encrypt their storage by default, with the keys tied to the device passcode, so setting a strong passcode is what makes the encryption effective. Device encryption is different from tools that help find the device or restore its data afterward — useful, but they do not by themselves keep a finder from reading what is stored on it.

Data in transit is protected by encrypting the connection or the message, and the key question is which part of the journey each method covers.

• HTTPS encrypts the connection between the browser and one website using TLS. It protects that web traffic on any network, including open public Wi-Fi, but covers web traffic only, and only for sites that use HTTPS.
• A VPN (virtual private network) creates an encrypted tunnel that carries all of a device's traffic to the VPN endpoint — for example, from a laptop on café Wi-Fi to the office network. Once traffic leaves the tunnel at the far end, the VPN no longer protects it, and the VPN gives network access to anyone who signs in with valid stolen credentials.
• Email encryption (for example S/MIME or PGP) encrypts the message itself, so it stays ciphertext while stored on and passed between mail servers, until the intended recipient opens it. HTTPS webmail or TLS between mail servers protects individual hops, but the message can still be read where it is stored.
• Mobile application encryption, in the form of end-to-end encryption in messaging apps, encrypts messages on the sender's phone and decrypts them only on the receiver's phone. The keys stay on the users' own devices, so even the company that runs the app cannot read the messages. Standard server-side encryption, and cloud backups that are not end-to-end encrypted, can leave the keys with the provider.

Real protection usually layers both kinds: a USB drive of payroll records, for example, needs encryption while it is carried around, and a separate protection such as an encrypted connection when the records are uploaded. Each covers what the other cannot.

Securing a new home or small-office wireless router starts with two changes: the default admin password and the SSID. The admin password protects the router's settings page. If it is left at the default, anyone who can reach the router — a neighbor on the network, or malware on a connected device — can sign in and change the Wi-Fi password, security mode or DNS settings, or open ports. This is the most important change, and it is separate from the Wi-Fi passphrase that devices use to join.

The service set identifier (SSID) is the network name that the router broadcasts. Default SSIDs often include the manufacturer's name or model number, which tells an attacker exactly which device to look up for default credentials and known flaws. Changing the SSID removes that clue; pick a name that also does not reveal personal details such as a family name or address. Changing or hiding the SSID does not encrypt traffic or control who can join — those come from the security mode and passphrase.

Many other router settings tune performance or addressing rather than security. Keeping the router's firmware updated is the other habit that matters.

The security mode decides whether a wireless network is encrypted or unencrypted and how devices prove they may join. An open network has no passphrase and, in its traditional form, no encryption: anyone in range can join, and anything not otherwise protected (such as plain-HTTP pages) can be captured by others nearby. HTTPS and VPN traffic stay encrypted on an open network, but the network itself adds no protection.

A pre-shared key (PSK) network — the "Personal" mode of WPA2, used in most homes — asks every device for the same passphrase when it first connects. The passphrase both controls who can join and is used to set up encryption for each device's traffic. Businesses often use "Enterprise" mode instead, where each user signs in with their own credentials checked by an authentication server.

The objectives spell WPA as "Wireless Protected Access"; the Wi-Fi Alliance's name is Wi-Fi Protected Access — same standards. The rule is simple: choose WPA3 where every device supports it. When some devices only support WPA2 — an older printer or game console, for example — use WPA2/WPA3 mixed (transition) mode: WPA3-capable devices connect with WPA3, and older devices connect with WPA2. Avoid any setting that brings back the original WPA.

Settings that do not secure a network

Hiding the SSID stops the router announcing the name, but devices that connect still send it, so the network is easy to discover. MAC address filtering allows only listed hardware addresses, but an attacker can watch the airwaves and copy an allowed address. Neither encrypts traffic. If a network has no passphrase, the fix for both unauthorized joining and readable traffic is a current passphrase-based security mode: WPA3 (or WPA2 where devices require it) with a long, unique passphrase.