Most of the password tips you've heard in the last twenty years are out of date. The requirement to change the password every quarter, mandatory special characters, capital letter and number, all this has been officially recognized as ineffective. The NIST Standards Institute, whose recommendations underpin security policies around the world, has rewritten its guidelines. The new edition of SP 800-63B directly cancels what we have been taught for years.

People think that accounts are hacked by choosing a password, and therefore try to come up with something more cunning. In fact, the main way to capture accounts remains credential stuffing. The scheme looks like this: attackers take login-password pairs that have leaked from one hacked service and automatically try them on hundreds of other sites. No one picks anything up, they just check if you used the same password somewhere else. Hence the single most important thing in the whole subject. It doesn't matter how complex your password is if it's the same on more than one service. One leak and all accounts are open. The average person has more than a hundred online accounts. It is physically impossible to remember a unique reliable password for everyone, and this is not your personal problem, but a drawback of the system itself.

Length works better than complexity

The old advice required capital letters, numbers and symbols, causing people to create something like P@ssw0rd! and they considered it safe. NIST eliminated these requirements by recognizing that complexity rules lead to predictable patterns. The person who is required to be symbolized puts an exclamation mark at the end. A person who is required to have a number adds a unit or year of birth. The logic of the new approach is as follows: the time to break increases exponentially with increasing length and only linearly with increasing complexity. Each added character gives more than replacing a letter with a character.

So a phrase like «blue kettle fell off the shelf» is more reliable than P@ssw0rd! and at the same time, it is easier to remember. Current landmarks: a minimum of 15 characters if the password is the only account protection, and from 8 characters if two-factor authentication is additionally enabled. For important accounts such as mail and bank, you should take 20 or more.

You no longer need to change your password according to the schedule

NIST explicitly states that passwords should not be changed on an arbitrary schedule. They need to be changed only when there is evidence of compromise. The reason is simple. A forced change every quarter causes people to make minimal modifications to the old password, adding the number to the end. The safety from this is not increasing, and the inconvenience is increasing. If your employer still requires a password change every 90 days, this is an outdated policy.

The password manager solves the main problem

Since it is impossible to remember a hundred unique passwords, you need a tool that does it for you. The password manager generates random passwords for each site, stores them in encrypted storage and substitutes them automatically. You only need to remember one master password, and it should be long. Implementing a password manager remains the most effective single improvement most people can make to their security. A typical objection sounds like this: what if the manager himself is hacked? There is a risk, but it is necessary to compare with a real alternative, and it consists in the fact that you use three passwords to a hundred sites. The second scenario loses by a wide margin. Which is definitely not suitable for storing passwords: notes in the phone without a password, a file on the desktop, a piece of paper under the keyboard, a message to yourself in the messenger.

Passkeys, or life without passwords

The technology replaces the password with a pair of cryptographic keys. The private key is stored on your device and never leaves it, and the service receives only the public key. The input is confirmed by the fingerprint, face or PIN code of the device. The main advantage is that there is nothing to steal. There is no password that can be leaked when the service is hacked. There is no password that can be lured by a phishing page, because the key is tied to a specific domain and simply will not work on a fake site. As of 2026, the technology is supported by Google, Apple, Microsoft, GitHub, Amazon, PayPal and many other services. If the service offers such an option, turn it on, because it is both safer and more convenient than the password. Passwords haven't disappeared yet, because support isn't everywhere, so you'll still need a password manager.

Two-factor authentication and why not all methods are the same

The second factor means that even with the correct password, the attacker will not log in without additional confirmation. It should be turned on wherever it is, but the methods differ in reliability.

SMS codes are the weakest option. They can be intercepted, and the number can be reissued through the operator using forged documents. At the same time, SMS is still much better than nothing, so if there is no other option, turn it on.

Authenticator applications generate codes locally on the device, without the involvement of a mobile operator. It is noticeably more reliable than SMS and is available almost everywhere.

Hardware keys in the form of a USB device provide the highest level of protection. Together with passkeys, they are the only ones that provide true resistance to phishing, because they are cryptographically tied to a specific site. Separately, it is worth remembering about backup codes. Services issue them when two-factor authentication is enabled, and they must be stored outside the phone, because it is the phone you can lose.

Mail is the key to everything

This is rarely thought of, but the mailbox opens access to the rest of the accounts through the password recovery function. An attacker who received your mail sequentially resets passwords to all services linked to it. Social networks, banking applications, work systems.

Therefore, mail requires the longest password, mandatory two-factor authentication and regular verification of the list of active sessions. If you see a login from a device or country you don't recognize, end the session and change your password.

How to know if your data has leaked

There are services that check the mail address based on known leaks. The most famous of these is Have I Been Pwned, and it takes a few seconds to check. If your address is found in the database, it means that the password from that service must be replaced wherever you used it. Many password managers do this check automatically and warn when the password is leaked.

If the account has already been hacked

Try logging in and changing your password right away. If access is already lost, use the recovery function via linked mail or phone. After access is restored, check the settings because attackers usually add their address to restore or forward mail. These changes remain even after changing the password and allow you to recapture the account.

Complete all active sessions on all devices. Change passwords on other services where the same password was used. Warn your contacts, because a hacked account is usually used to send fraudulent messages on your behalf, and it is loved ones who become the next victims.

If it is about financial losses, contact the bank and cyber police. More about this in the article on fraud recognition.

Minimum plan for today

  1. If you don't have the strength to do everything at once, here's the order by decreasing benefit:
  2. Enable two-factor authentication in mail
  3. Put a long unique password in the mail
  4. Set password manager
  5. Check your address for leaks
  6. Replace passwords where they are repeated
  7. Enable passkeys on services where they are available
  8. Save backup codes in a safe place

The old security model was built around a complex password that a person had to remember and change regularly. This model did not work because it contradicted how memory is arranged.

Long unique passwords are generated by the program, a person remembers one master password, and critical accounts are additionally protected by a second factor or do not have a password at all thanks to passkeys. Uniqueness is more important than complexity, and two-factor authentication on mail gives more security than any effort to come up with clever combinations.


Sources: Authentication Security Industry Materials.