Passwords: What Changed, and What to Do Now

Most password advice people follow was withdrawn years ago by the organisations that issued it. Forced monthly changes, mandatory symbols, and complexity rules were found to make security worse rather than better — because they push people toward predictable patterns.

Here is what replaced them.

What was wrong with the old rules

Forced regular changes. People respond by making small predictable modifications — adding a number, incrementing it, changing a season. An attacker who has one password can frequently guess the next. Current guidance is to change a password when there is reason to believe it is compromised, not on a schedule.

Mandatory symbols and mixed case. These produce passwords that are hard for humans to remember and barely harder for computers to break. People satisfy the rule in the same few ways — a capital at the start, a number and an exclamation mark at the end — and attackers know this.

Short but complex. An eight-character password with every character class is weaker than a longer simple one, because length matters far more than the size of the character set.

What actually makes a password strong

Length, above everything else. Each additional character multiplies the work of guessing it.

Unpredictability. Not randomness in the mathematical sense — just not being something a guessing program would try. A common phrase, a song lyric, a name and a birth year are all weak regardless of length.

Not being reused. The most important property in practice. Breaches happen constantly, and reused passwords mean one breach opens every account.

Not appearing in a breach. Attackers try known-breached passwords first, and any password that has appeared in one is worthless regardless of its structure.

What to actually do

Use a password manager

The single most valuable thing in this article.

It generates long random unique passwords for every account, remembers them, and fills them in. You remember one.

Browser-built managers are adequate and enormously better than nothing. Dedicated ones work across browsers and devices and offer more.

One strong passphrase protects it, plus two-factor authentication on the manager itself.

The common objection — "what if it is breached" — is answerable. Reputable managers store your data encrypted with a key derived from your master password, which they do not hold. A breach of their servers does not directly expose your passwords. And the alternative, reusing passwords across sites, is a far larger risk that is realised constantly rather than hypothetically.

For the few you must remember

Your device login, your password manager, and possibly your email.

Use a passphrase: four or five unrelated words. Long, memorable, and not guessable.

Unrelated is the key word. Words that go together naturally are far weaker than words that do not.

Do not use: song lyrics, quotations, famous phrases, or anything published anywhere.

Enable two-factor authentication

More valuable than any password improvement. Even a stolen password does not grant access without the second factor.

Priority order: email first, because it resets everything else. Then banking, then anything holding money or personal data, then social accounts.

An authenticator app beats text messages, which are vulnerable to number-porting attacks. A hardware key beats both.

Save the recovery codes somewhere separate. Losing access to the second factor without them is a genuine problem. See two-factor authentication.

Check your exposure

Established breach-notification services let you check whether your email addresses appear in known breaches, free.

If they do, change those passwords and anywhere you reused them.

Many password managers check continuously and flag reused and breached passwords for you.

Passkeys

The direction things are moving, and worth understanding.

A passkey replaces the password with a cryptographic key stored on your device and unlocked by your fingerprint, face or device PIN.

Why it is better: nothing to remember, nothing to type, nothing that can be phished, and nothing stored on the server that is useful to steal.

Where it stands: supported by the major platforms and by a growing number of services. Adoption is uneven, so passwords remain necessary alongside them.

Worth enabling where offered, particularly on important accounts.

Practical points

Do not write passwords on a note by the machine. A written list kept somewhere genuinely secure is a defensible choice for someone who cannot use a manager, and it should not be beside the computer.

Do not share accounts where the service offers separate users. Where you must, use the sharing feature of a password manager rather than sending it in a message.

Change a password immediately if a service reports a breach, you used it on a site that was breached, you entered it somewhere suspicious, or you shared it.

Do not change passwords on a schedule otherwise.

Security questions are frequently the weak point. The answers are researchable. Treat them as additional passwords and store random answers in your manager.

Check what your recovery options are. An account recoverable through an email address you no longer control is an account you will lose.

Helping someone less confident

A password manager is the answer here too, and setting it up with them is a genuinely useful afternoon.

Start with the accounts that matter — email and banking — rather than trying to convert everything at once.

Enable two-factor on their email and make sure they understand what the prompts mean, because that understanding is what prevents approval-fatigue attacks.

Write down the recovery information and keep it somewhere they and one trusted person can find.

The short version

Length beats complexity, and forced regular changes make things worse — the organisations that recommended them have withdrawn that advice.

Reuse is the real risk, and a password manager removes it entirely.

Two-factor on your email first, because email resets everything else.

A passphrase of four or five unrelated words for the handful you must remember.

And check whether your addresses appear in a breach — it is free and it takes two minutes.

For practical baseline security guidance for home users, see CISA Secure Our World.