Most password advice is outdated. "Change your password every 90 days!" "Use a mix of uppercase, lowercase, numbers, and symbols!" That advice made sense in 2005. In 2026, it actually makes things worse.
Here's what current research and real-world breach data actually tell us about password security.
The Old Rules Are Wrong
Forced Password Rotation Is Dead
NIST (the U.S. National Institute of Standards and Technology) updated their guidelines years ago: don't force regular password changes. Why? Because when you make people change passwords every 90 days, they create predictable patterns.
"Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise."
— NIST Special Publication 800-63B, Digital Identity GuidelinesSummer2024! becomes Fall2024! becomes Winter2025!
Attackers know this. Password cracking tools include these patterns by default. You're not adding security — you're adding predictability.
The fix: Only change passwords when there's evidence of compromise. Use monitoring instead of rotation.
Complexity Requirements Backfire
Requiring uppercase, lowercase, numbers, and symbols sounds secure. In practice, it leads to passwords like:
Password1!Company2026!Welcome123$
These meet every complexity requirement and are cracked in seconds. The requirements push people toward the minimum viable password, not a secure one.
"Highly complex memorized secrets introduce a new potential vulnerability: they are less likely to be memorable, and it is more likely that they will be written down or stored electronically in an unsafe manner."
— NIST SP 800-63B, Section 5.1.1.2What Actually Works
1. Length Over Complexity
A 20-character passphrase with only lowercase letters is harder to crack than an 8-character password with every character type.
Math: An 8-character password with 95 possible characters has about 6.6 quadrillion combinations. A 20-character lowercase-only password has about 19 septillion combinations. The longer password wins by a factor of nearly 3 million.
Minimum recommendation: 14 characters. Longer is better.
2. Passphrases Are Superior
Instead of J#kL9$mN, use correct-horse-battery-staple (the famous XKCD example). Passphrases are:
- Easier to remember
- Easier to type
- Harder to crack
- Harder to shoulder-surf
Pick 4-6 random words. Make them genuinely random — not a phrase from a song or book.
3. Password Managers Are Non-Negotiable
The average person has 100+ online accounts. You cannot have unique, strong passwords for each without a password manager. Period.
"Use a password manager to generate and store unique passwords for each of your accounts. Password managers create complex passwords and remember them so you don't have to."
— CISA (Cybersecurity & Infrastructure Security Agency), Use Strong PasswordsGood options: Bitwarden (open source, free tier), 1Password, KeePass (local-only). The specific tool matters less than actually using one.
Critical rule: Your password manager's master password must be your strongest password — a long passphrase you've genuinely memorized.
4. Check Against Breach Databases
When someone creates a password, check it against known breached passwords. If "Password123!" has appeared in 50 million breaches, don't let people use it.
Have I Been Pwned offers a free API for this. Many password managers do this check automatically.
MFA Changes Everything
Multi-factor authentication (MFA) is more important than password complexity. Even a weak password becomes dramatically harder to exploit when combined with a second factor.
"MFA can block over 99.9 percent of account compromise attacks."
— Microsoft Security Research, 2019 StudyMFA Tiers
- SMS codes: Better than nothing, but SIM swapping attacks exist. Use if it's your only option.
- Authenticator apps: TOTP apps like Google Authenticator or Authy. Much better than SMS. Free and works offline.
- Push notifications: Microsoft Authenticator, Duo. Convenient but watch for "MFA fatigue" attacks where users approve prompts just to stop the notifications.
- Hardware keys: YubiKey, Google Titan. The gold standard. Phishing-resistant because the key verifies the actual website domain.
Priority: Enable MFA everywhere, especially email, banking, and anything that can reset other passwords.
Attack Realities
Understanding how passwords get stolen helps you defend against actual threats:
Credential Stuffing (Most Common)
Attackers take username/password pairs from one breach and try them on other sites. Password reuse makes this devastating.
Defense: Unique passwords for every site. A password manager makes this practical.
Phishing
Tricking users into entering passwords on fake login pages. No password complexity helps here — if you type your password into a fake site, it's compromised.
Defense: Security awareness training. Password managers that auto-fill (they won't fill on the wrong domain). Hardware security keys (phishing-resistant).
Brute Force / Dictionary Attacks
Trying passwords until one works. Common passwords fall in seconds. This is where length and randomness matter.
Defense: Long, random passwords. Account lockouts after failed attempts. Rate limiting.
Keyloggers / Malware
If malware is on the device, it captures passwords as you type. No password policy prevents this.
Defense: Endpoint protection. Keep systems patched. MFA (the second factor isn't captured by keyloggers).
For System Administrators
If you're setting password policies for your organization:
"Do not impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) on memorized secrets."
— NIST SP 800-63B, Password Guidelines- Minimum length: 14 characters (NIST recommends at least 8, but longer is better)
- No complexity requirements: Drop the uppercase/lowercase/number/symbol rules
- No forced rotation: Change on evidence of compromise only
- Block common passwords: Check against breach databases
- Require MFA: For all users, not just admins
- Provide a password manager: Give users tools to succeed
Make it easy to do the right thing. Inconvenient security gets bypassed.
Passkeys: The Future
Passkeys (FIDO2/WebAuthn) are replacing passwords entirely for supported services. Instead of a password, your device holds a cryptographic key. You authenticate with biometrics or a PIN, and the device handles the rest.
"Passkeys are a replacement for passwords. They are faster to sign in with, easier to use, and much more secure."
— FIDO Alliance, Passkeys OverviewBenefits:
- Phishing-resistant (the key is bound to the specific website)
- Nothing to remember
- Nothing to type (nothing to keylog)
- Unique per site by design
Major platforms (Google, Apple, Microsoft) now support passkeys. Enable them where available — they're the most secure option for consumer services.
Quick Actions
- Get a password manager and start migrating your passwords
- Enable MFA on your email — it's the key to all other accounts
- Check haveibeenpwned.com to see if your email appears in breaches
- Replace your weakest passwords (short, reused, or dictionary words)
- Set up passkeys on Google, Apple, or Microsoft accounts if you haven't
Perfect security isn't the goal. Being harder to attack than the next target is.
💬 Comments (0)
Loading comments...