Most password advice is decades out of date. Complexity rules produced passwords that were hard for humans and easy for machines. The current guidance is simpler and it works.
The three rules that matter
- Long. Length defeats brute force far more effectively than punctuation. Fifteen characters of anything beats eight characters of chaos.
- Unique. Every account gets its own. This is the important one.
- Not previously breached. Attackers do not guess. They replay username and password pairs stolen from other services.
Why reuse is the real risk
The attack is called credential stuffing. A shopping site is breached, its user list is published, and automated tools try those same combinations against banks, mail providers and hosting portals. Your password to our client area may have been strong; if it was also your password on a forum that was breached in 2019, its strength is irrelevant.
One reused password can compromise every account it was used on. Nothing else on this list is as important as fixing that.
Why a password manager is the answer
Unique long passwords for every account are impossible to remember, and that is fine, because you should not be remembering them. A password manager generates them, stores them encrypted and fills them in. You memorise one strong passphrase for the manager itself.
A useful side effect: a password manager will not autofill on a lookalike domain, because it matches on the exact address. It catches phishing sites that fool people.
Any reputable manager is far better than none. Choose one, install it on every device, and spend an hour moving your accounts into it starting with email, banking and this portal.
The master passphrase
Four or five unrelated words are easier to remember and harder to crack than a short scrambled string. Do not reuse it anywhere. Write it down and store it physically somewhere secure if that is what makes it possible for you — a written passphrase in a locked drawer is a far smaller risk than a weak one you can remember.
Habits to drop
- Rotating passwords on a schedule for no reason. It reliably produces predictable variations. Change a password when there is a reason to.
- Storing passwords in a spreadsheet, a document, or your browser's notes.
- Emailing credentials to colleagues. Use the manager's sharing feature.
- Keeping a shared login for a system several people use. Individual accounts mean you can remove one person's access when they leave without disrupting everyone.
Then add two-factor
A strong unique password protects against guessing and reuse. Two-factor authentication protects against the password being stolen anyway. Use both on anything that matters — see the article on choosing a two-factor method.
