Password Security Basics: What Actually Keeps You Safe
Most password advice you've absorbed over the years is either outdated or was never quite right — forced monthly changes, "must contain a symbol," memorizing dozens of passwords by hand. Here's what security researchers actually recommend now, and the small number of habits that matter far more than any single password.
Length beats complexity, and the old rules are gone
For years, sites forced you into rules like "one uppercase, one number, one symbol" and expiring passwords every 90 days. NIST — the U.S. agency whose password guidance most companies eventually follow — has walked both of those back. Its updated guidance (SP 800-63B) recommends passwords of at least 15 characters when a password is the only thing protecting an account, drops mandatory composition rules, and no longer requires periodic rotation unless there's actual evidence of a breach.
The reasoning holds up: composition rules push people toward predictable patterns (capital letter first, "!" or "1" at the end), which narrows the guesses an attacker actually has to try. Forced rotation does something similar — people tweak "Summer2025!" into "Summer2026!" rather than picking something new, and once an attacker has cracked one version, the next one is a one-guess problem. A long, random string beats a short "clever" one every time, because each additional character multiplies the number of combinations an attacker has to search — not just adds to it.
| Password style | Why it fails (or holds up) |
|---|---|
| "password123", "qwerty", "123456" | Already in every attacker's wordlist — cracked instantly regardless of length |
| "P@ssw0rd!" (rule-following but short) | Letter-symbol swaps are the first thing cracking tools try; barely stronger than the plain word |
| 8 characters, mixed case only | Crackable in hours to days on modern hardware |
| 16+ random characters, generated by a tool | Not practically crackable — the search space is too large to brute-force |
| 4-5 random unrelated words ("orbit velvet thunder maple") | Long enough to resist brute force, easier for a human to actually remember |
The habit that matters more than any single password
Even a perfect password doesn't help if you reuse it. Attackers don't usually crack your password directly — they buy or scrape lists of email/password pairs leaked from some other breached site, then try those same pairs everywhere else (a technique called credential stuffing). Weak or reused credentials are consistently one of the top causes of account compromise industry-wide, and the fix isn't a smarter password — it's a different password on every single account, so one leaked site can't unlock the rest of your accounts.
That's only realistic with help. Nobody can memorize forty unique 16-character strings, which is why the two tools below matter more than any individual password choice:
- A password manager. It generates and stores a unique password per site, so you only ever memorize one strong master password. Every major browser now has one built in, and dedicated apps sync across devices.
- Two-factor authentication (2FA). A second step — a code from an app, or a tap on your phone — means a leaked password alone isn't enough to get in. Turn it on for email first, since email is usually the reset path into everything else, then banking and anything else sensitive.
Generating a password you don't have to invent
Making up a "random" password in your head is harder than it sounds — humans are bad at randomness and default to patterns without realizing it. The free CalcPerch Password Generator uses your browser's built-in cryptographic randomness to create a genuinely random password of any length, with toggles for uppercase, numbers, and symbols, and nothing is sent anywhere — it runs entirely on your device. Generate one, save it straight into your password manager, and you're done; there's nothing to remember for that account at all.
For the handful of passwords you do need to type from memory — your device lock, your password manager's own master password — a passphrase of four or five random, unrelated words is the better trade-off. It's long enough to resist brute-force guessing but structured in a way your memory can actually hold onto, unlike a random string of symbols.
Signs a password (or account) needs to change now
Under current guidance you don't need to rotate passwords on a schedule, but you should change one immediately if any of these happen:
- A site notifies you it was breached, or a breach-checking service flags your email as part of a leak.
- You reused that password somewhere else that later got breached — even if this particular site wasn't the one breached.
- You typed it into a site after clicking a link in an unexpected email or text (possible phishing).
- You shared it with someone, even briefly, for a legitimate reason (letting someone into an account temporarily, for example).
Outside of those triggers, changing a genuinely strong, unique password on a fixed schedule adds inconvenience without adding real security — which is exactly why the old "change it every 90 days" rule has been dropped.
Common myths worth retiring
| Myth | Reality |
|---|---|
| "Adding a symbol makes any password strong" | Only if the whole password is long and unpredictable — one symbol on a short, guessable base does almost nothing |
| "I'll remember it better if it means something to me" | Meaningful phrases (birthdays, pet names, song lyrics) are exactly what targeted-guessing and social-engineering attacks are built to try first |
| "Password managers are a single point of failure" | A strong, unique master password plus 2FA on the manager itself is far safer than reusing weak passwords everywhere to avoid using one |
| "I have nothing worth hacking" | Compromised accounts get used to reset other accounts, send scam messages to your contacts, or resell access — the target is often not you specifically, just an available account |
Sources
Password guidance here follows the current US federal standard, which reversed much of the older advice:
- NIST SP 800-63B — Digital Identity Guidelines, Authentication — why length beats forced complexity, and why routine expiry is no longer recommended.
- CISA — Use strong passwords — the current US government public guidance.
- Have I Been Pwned — checking whether an address appears in a known breach.
Frequently asked questions
Is a longer password always better than a more complex one?
For random passwords, yes — each additional character multiplies the possible combinations, while composition rules (must include a symbol, etc.) tend to reduce randomness because people apply them in predictable ways. Current NIST guidance recommends prioritizing length (15+ characters when possible) over composition rules.
Do I really need a password manager, or can I just remember strong passwords?
You can memorize one or two strong passphrases, but not a unique strong password for every account you have — and reusing one password across accounts is one of the most common ways breaches spread. A password manager is what makes "a different strong password per site" realistic without writing them down somewhere insecure.
How often should I change my passwords?
Not on a fixed schedule. Change a password when there's a specific reason — a breach notice, suspected phishing, or reuse on a site that got breached — rather than routinely, since forced rotation without a reason tends to produce weaker, more predictable passwords.