A password is still the lock on most of your accounts, and most people choose it badly. The problems are rarely dramatic. They’re a password reused on ten sites, a short one with a “1!” on the end, or one that’s easy to guess.
This page explains how passwords get stolen or guessed, what makes one strong, when to change one, and where to keep them all. It doesn’t cover two-factor authentication or passkeys in depth. It mentions where they fit.
What a password protects, and how it fails
A password proves you’re you. It fails in three common ways.
The first is reuse. When a service is breached and your email and password leak, attackers try that pair on other sites. This is called credential stuffing. In Google’s account hijacking study with New York University and the University of California, San Diego, most attacks came from automated bots using passwords exposed in breaches of other sites. A strong password doesn’t help if it’s the same one that already leaked.
The second is guessing. If a service stores passwords poorly and is breached, attackers can run guesses against the stolen data at high speed. Short and predictable passwords fall first.
The third is tricking you into handing it over. Phishing sites and fake calls collect passwords directly, however strong they are. CISA, the US cybersecurity agency, describes weak passwords as the most common way online criminals access accounts.
One password for each account
Reuse turns one leak into many. A breach at a small forum you forgot about gives attackers a password that may also open your email.
People know this and still do it. In NordPass’s 2025 survey, 62% of Americans said they often or always reuse a password. NordPass sells password managers, so treat the number as indicative. The reason is plain: nobody can memorise dozens of different passwords. That’s the job of a password manager, covered below.
Length and randomness beat complexity
For years, services demanded a capital letter, a number and a symbol. People answered with predictable patterns such as Password1!. The UK’s National Cyber Security Centre (NCSC) argues that rules like these permit bad passwords such as “pa55word”. The US standards body NIST has moved the same way. Its SP 800-63B-4 guidance, finalised in August 2025, bans mandatory composition rules, sets a 15-character minimum where a password is the only login step, and asks services to accept at least 64 characters.
Two kinds of password work well, depending on whether you have to type them.
| Type | Best for | Notes |
|---|---|---|
| Random characters from a generator | Accounts you never type by hand | CISA suggests at least 16 characters |
| Random passphrase of six or more words | A password manager’s master password, device unlock | The EFF says six words give about 77 bits of entropy |
| Three random words | Passwords you must remember and can’t store | The NCSC says it’s usable but not perfect, and more words are stronger |
Random characters
If a password manager creates and fills in the password, it can be long and unreadable. CISA’s guidance is at least 16 characters, and says a random string of letters, numbers and symbols is the strongest option. Some services cap the length or ban certain characters, so use the longest the service allows.
Passphrases
A passphrase is several words strung together. You can remember it, and it’s long. The method the Electronic Frontier Foundation (EFF) recommends is a dice-based approach called Diceware. You roll five dice to pick each word from a list of 7,776 words. For most uses the EFF recommends six words.
Strength here is measured in entropy, a measure of how unpredictable something is. Each word from that list adds about 12.9 bits. Each extra word multiplies the number of possible passphrases by 7,776, and six words come to about 77 bits. The words must be chosen at random. If you pick them yourself, you’ll choose predictable combinations, which is why a tool or real dice should do the picking. An example of the style, for illustration only and never to be used, would be pencil sunset glacier bargain violet ribbon.
The NCSC has advised “three random words” since 2016 for people who don’t use a password manager. It says that’s easier to remember, tends to be longer than a complex short password, and is harder to guess than a rule-based one. The NCSC concedes it isn’t perfectly safe, because people may pick predictable words, and that more words are stronger.
For a manager’s master password, Privacy Guides recommends at least seven words, which gives about 90 bits. The reasoning is that this password protects everything else.
Leave rotation alone unless there’s a reason
Forced password changes every 90 days have fallen out of favour. NIST now says services shouldn’t require periodic changes, but should require one when there’s evidence of compromise. The reason is that frequent changes push people toward small, predictable edits.
Privacy Guides makes a related point about passwords you have to remember: changing your master password often only raises the risk that you’ll forget it. For passwords stored in a manager, it suggests that people with higher risks may want to rotate important accounts that lack two-factor authentication. That’s a judgement call that depends on your threat model.
The useful trigger is exposure. Have I Been Pwned lets you check whether an email address appears in known breaches, and its Pwned Passwords service lets you check a password without sending it. The check sends only the first five characters of the password’s hash, so the service never learns the password. A password that isn’t on the list isn’t necessarily safe, and a listed one should be replaced everywhere you used it.
Where to keep your passwords
CISA says generating and remembering long, random, unique passwords for every account isn’t possible for most people, and recommends a password manager. A manager creates, stores and fills in passwords, and many warn you about weak or reused ones. You remember one strong password, the master password, and the manager handles the rest. The NCSC also prefers managers, and offers three random words for people who don’t use one.
Managers aren’t risk-free. In 2022 attackers who first compromised a developer’s account later reached LastPass’s cloud backup storage and copied customer vault data. The stored logins were encrypted with keys derived from each user’s master password, but website addresses weren’t encrypted. Security writers noted that LastPass had raised its master-password minimum to 12 characters only in 2018, and that older accounts weren’t forced to update. LastPass said that following its recommended practices makes brute-forcing extremely difficult. Changing a master password afterwards doesn’t undo a vault that has already been copied.
The lesson isn’t to avoid managers. It’s that the master password carries real weight, so make it long, random and used nowhere else. Privacy Guides also advises keeping an encrypted backup of your passwords on more than one device or provider, so losing a phone doesn’t lock you out of everything.
What passwords can’t do
A perfect password still fails against phishing, because you hand it over yourself. A second login step adds protection if a password leaks. A passkey, a login based on cryptographic keys, is designed to resist phishing and removes the password altogether. Account creation explains how passkeys work and when to use them. Because a password manager’s master password is the one you can’t replace with a manager, it’s worth turning on every extra protection it offers.
Where to start
These steps run from most to least useful.
- Start with your email account, since other services use it to reset passwords. Give it a long, random, unique password.
- Choose a password manager and use it to generate a different password for every other account, starting with banking and any account that holds money or identity.
- Make the manager’s master password a random passphrase of six or more words. Write it down somewhere safe until you know it by heart.
- Turn on a second login step for email, the manager and your bank.
- Replace any password that has appeared in a breach, and anywhere you reused it.
How much effort each step deserves depends on what an account protects. Threat modeling helps you decide, and common threats shows what you’re most likely to face.
Sources
- Introduction to Passwords, Privacy Guides, 2025.
- New research: How effective is basic account hygiene at preventing hijacking, Google Security Blog, 2019.
- Use Strong Passwords, Cybersecurity and Infrastructure Security Agency, accessed October 2026.
- Secure Our World Passwords Tip Sheet, CISA (hosted by Mass.gov), 2023.
- Stop reusing passwords, NordPass, 2025.
- SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, National Institute of Standards and Technology, 2025.
- NIST 800-63B Rev 4: What’s New in Password Security, Enzoic, 2025.
- NIST-SP800-63B-4: Deciphering the New Password Security Standard, Nat Sakimura, 2025.
- Using three random words is safer than using complex passwords, NCSC says, Computing, 2021 (reporting NCSC guidance).
- Want a strong password? You’re probably still doing it the wrong way, HKCERT, 2022 (reporting NCSC guidance).
- EFF’s New Wordlists for Random Passphrases, Electronic Frontier Foundation, 2016.
- Validating Leaked Passwords with k-Anonymity, Cloudflare, 2018.
- Go client for the Pwned Passwords API, package documentation, accessed October 2026.
- Get Breach Notifications, Have I Been Pwned, accessed October 2026.
- LastPass Shares Details of Security Breach, TidBITS, 2022.
- LostPass: after the LastPass hack, here’s what you need to know, Graham Cluley, 2022.
- What Has Happened?, University of New England cybersecurity blog, 2023 (quoting LastPass’s statement).