So as a user, what can you do to help your password? There are three takeaways:

1. Prioritize password length above all else — the amount of variance grows exponentially, thus the security of a 20 digit password is unfathomably greater than one of half its size. 15 characters should be the absolute minimum.

If you are using english words inside your password. 2. Don’t even bother with “normal” substitutions, like l33tspeak. Instead insert your l33tspeak into the middle of words or substitute the wrong letters to throw off permutation seekers — for example, instead of “Z3RO” you could have “Z3ERO” or “Z5RO” as stronger alternatives. Adding a “1” or “123” to the end of your password is similarly useless, try inserting it into the middle of your password instead if you must.

3. Change your passwords! If you use weak passwords for small and/or incompetent companies, they will be broken eventually and you may not even notice. Make sure your passwords for important services (email, banking, etc) are completely different from those you use for other accounts.

Other than that, there is very little you can do except hope