For years we were told to make passwords "complex": one capital, one number, one symbol, change it every 90 days. The result? Passwords like Summer2024! that are easy to guess and impossible to remember across dozens of accounts. Security guidance has since changed, and most people have not caught up.
This guide explains what actually makes a password strong today, based on current NIST guidance (SP 800-63), and how to make secure habits painless.
Key takeaways
- Length beats complexity. NIST requires at least 15 characters for single-factor passwords (8 minimum when combined with MFA).
- Use unique passwords for every account; reuse is how breaches spread.
- Do not rotate on a schedule; change only after a suspected compromise.
- Use a password manager and turn on multi-factor authentication (MFA).
What NIST says now
The US National Institute of Standards and Technology publishes widely followed digital identity guidelines. Their current recommendations for services that verify passwords include:
- Minimum length: at least 15 characters if the password is the sole factor; at least 8 if used only as part of multi-factor authentication.
- Allow long passwords: systems should accept at least 64 characters.
- No composition rules: no forced mixes of uppercase, numbers or symbols.
- No periodic changes: require a change only on evidence of compromise.
- Block bad passwords: check new passwords against lists of commonly used and previously breached values, dictionary words and context-specific terms such as the username or service name.
- Allow password managers and pasting: never block autofill or paste.
These rules are aimed at website and system owners, but they reveal what makes passwords safe for everyone.
Why length beats "clever" substitutions
Attackers do not type guesses by hand. They use software that tries billions of guesses against stolen password databases, using wordlists and common substitutions (@ for a, 0 for o). P@ssw0rd! is in every cracking list. A long, random or multi-word passphrase has far more possible combinations, so cracking becomes impractical.
Four ways to create a strong password
1. Let a password manager generate it (best)
Random strings such as 20 characters of mixed characters are strongest and you never need to remember them. Try our free, private password generator, which runs in your browser.
2. Use a passphrase for the few you must memorise
Choose four or more unrelated words, for example: copper-lantern-river-bicycle. Add words rather than symbols to increase strength. Avoid quotes, song lyrics and anything connected to you.
3. Make it unique for every account
If one site is breached and you reused the password, criminals try it everywhere (credential stuffing). Unique passwords contain the damage.
4. Never build passwords from personal facts
Names, birthdays, pet names, phone numbers and sports teams are easy to find on social media.
Passwords to avoid
- 123456, password, qwerty, letmein and other top-ten breaches.
- Your name, company name, or website name plus a number.
- Keyboard walks like qazwsx.
- Seasonal patterns like Winter2026!
- The same password with a small change per site.
Password managers: what they are and how to choose one
A password manager stores all your credentials in an encrypted vault, generates strong passwords, fills them in automatically and warns you about weak, reused or breached ones. You remember one strong master passphrase.
What to look for
- Strong encryption and zero-knowledge design (the provider cannot read your vault).
- Independent security audits and a transparent track record.
- MFA support for the vault, ideally with hardware keys or authenticator apps.
- Cross-device sync on phone, desktop and browser.
- Sharing and team features if you run a business, with admin controls and offboarding.
- Passkey support and emergency access.
- Reasonable price and an export option so you are never locked in.
How to set one up in 30 minutes
- Choose a reputable manager and create a master passphrase of five or more random words. Write it down and store it somewhere safe at home.
- Turn on MFA for the manager itself.
- Install it on your phone and browser.
- Import saved passwords from your browser, then delete them from the browser store.
- Change the passwords of your most important accounts first: email, banking, cloud storage and social media.
- Work through the "reused" and "weak" report over the next few weeks.
Turn on multi-factor authentication (MFA)
Even the best password can be phished. MFA adds a second proof:
- Authenticator app codes (good).
- Hardware security keys and passkeys (best; resistant to phishing).
- SMS codes (better than nothing, but weaker because numbers can be hijacked).
Prioritise email first, because it resets everything else, then financial, cloud, social and work accounts.
Passkeys: the passwordless future
Passkeys use public-key cryptography stored on your device and unlocked with your fingerprint, face or PIN. There is no shared secret to phish or leak. Use them wherever sites offer them, and keep a strong password plus MFA as a backup elsewhere.
For businesses and teams
- Provide a company password manager and prohibit sharing passwords in chat or spreadsheets.
- Enforce MFA on email, VPN, admin panels and cloud consoles.
- Block known-breached and common passwords at sign-up.
- Do not force periodic resets; do force resets after suspected compromise.
- Have an offboarding checklist that removes access the day someone leaves.
- Monitor for credential leaks involving your domain.
Weak credentials are one of the most common ways attackers get in; see our guide to small business cybersecurity threats.
If you think a password was compromised
- Change it immediately, along with any other account that used it.
- Revoke active sessions and connected apps.
- Check your email for forwarding rules and recovery changes.
- Enable or reset MFA.
- Watch financial accounts for unusual activity.
How attackers actually crack passwords
Knowing the methods explains why length and uniqueness beat clever tricks:
- Credential stuffing: bots try email and password pairs from past breaches on many other sites. Reused passwords fall instantly.
- Dictionary and rule attacks: software tries common words plus predictable changes (capital first letter, number at the end, @ for a).
- Brute force: trying every combination. Time grows enormously with each extra character, which is why length matters.
- Phishing: fake login pages that capture whatever you type. Strong passwords do not help; MFA and passkeys do.
- Malware and keyloggers: steal passwords from infected devices. Keep devices updated and use endpoint protection.
- Shoulder surfing and sticky notes: low-tech, still common.
Check whether your accounts have been exposed
- Search your email addresses on a reputable breach-notification service such as Have I Been Pwned.
- Change the password for any listed service and any other account that shared it.
- Turn on breach alerts in your password manager if offered.
- Enable MFA on the affected accounts.
Passphrase examples and tips
| Type | Example | Notes |
|---|---|---|
| Weak | Dhaka2026! | Short, predictable pattern, personal |
| Better | correct-horse-battery-staple | Famous example, so now appears in attack lists; do not use it |
| Good | lantern-gravel-orbit-pencil-maple | Five unrelated words, easy to type and remember |
| Best for most accounts | Random 20+ characters from a manager | You never need to remember it |
For your master passphrase, use five or six random words chosen by dice or a generator, not by you. Our password generator can create them in your browser.
Security questions and account recovery
- Treat security questions as extra passwords: answer with random strings stored in your manager, not true facts.
- Set up recovery methods (backup codes, a second email) and store them safely.
- Secure your email account above all; whoever controls it can reset everything else.
- Review recovery phone numbers and emails regularly.
Sharing passwords safely
- Use the sharing feature of a team password manager with specific permissions.
- Never send passwords by email or chat, and never in screenshots.
- Rotate shared credentials when someone leaves.
- Prefer individual accounts to shared logins so actions are traceable.
Need help securing your business?
Our cybersecurity team helps companies roll out password managers, MFA and access policies without disrupting work. Contact us for a free security checkup.
