Cybersecurity

Password Security Fundamentals

Passwords are still the key to most of your digital life, and most of them are weaker than they should be. The good news is that the rules have got simpler: length matters more than complexity, uniqueness matters more than cleverness, and a password manager does the hard work for you. This guide covers the fundamentals, anchored in the current guidance from NIST, the US National Institute of Standards and Technology.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Why passwords still matter

Passwords are the oldest security technology on the internet, and they remain the most common way into an account. Attackers do not usually break passwords by guessing — they steal them in data breaches, capture them in phishing, or buy them from earlier breaches and try them everywhere else. A password that is long, unique and never reused defeats most of those attacks at once.

Passwords are also the weakest link in most people's security, because they are asked to do an impossible job: remember dozens of different secrets. The answer is not a better memory but a better system. A password manager remembers them for you, and two-factor authentication means a stolen password alone is not enough. Together, they turn a fragile habit into a strong defence.

What NIST says now: SP 800-63B Revision 4

The authoritative guidance for passwords in the United States is NIST Special Publication 800-63B, part of the Digital Identity Guidelines. Revision 4 was finalised in July 2025, replacing the 2017 edition, and it changed the advice in ways that matter for everyday users. Its rules are written for the services that check your password, but they double as a list of good habits.

The headline change is length. A password used as the only way to sign in must be at least 15 characters long. A password used only as part of multi-factor sign-in may be as short as eight characters. Services must accept passwords of at least 64 characters, and must accept all printable characters and spaces — which means passphrases of several words are explicitly supported.

Revision 4 also ends two old practices. Services shall not impose composition rules — no more forcing a capital letter, a number and a symbol. And services shall not require passwords to be changed periodically: a change should be forced only when there is evidence the password has been compromised. It also requires services to screen new passwords against lists of known breached and commonly used passwords. Last checked: 14 November 2026.

Length beats complexity

The reason length matters is simple maths. Each extra character multiplies the number of possible passwords, and a long passphrase of ordinary words is both harder to guess and easier to remember than a short string of symbols. A 15-character password is enormously stronger than an 8-character one, however complex the shorter one looks. Our guide on password entropy explains the numbers in plain English, including why the commonly quoted targets disagree.

Complexity rules — must contain a symbol, must contain a number — mostly made passwords harder for people and barely harder for attackers, because everyone used the same tricks: a capital at the start, a number at the end, an exclamation mark. Attackers know these patterns. A passphrase such as four random words is stronger and kinder to your memory, and it is exactly what the current guidance supports.

The practical rule: aim for at least 15 characters on important accounts, longer where you can, and use a passphrase of random words or a generated password from a password manager. Never reuse a password across accounts — uniqueness is more important than any single password's strength.

Uniqueness: the rule that matters most

If you reuse one password on ten accounts, a breach at any one of them compromises all ten. Criminals know this and automate it: stolen passwords from one breach are tried against email, banking, shopping and social media within minutes. The single most impactful password habit is to give every account its own password, starting with your email — because access to your email lets an attacker reset almost everything else.

Uniqueness is impossible to achieve by memory for more than a handful of accounts, which is why a password manager is the central recommendation of this guide. It generates a long, random, unique password for every account, stores them encrypted, and fills them in for you. You remember one strong master password — a long passphrase — and the manager remembers the rest.

Password managers: what they do and how to choose

A password manager stores your passwords in an encrypted vault, locked by one master password. It generates strong passwords, fills them in on websites and apps, warns you when a password is reused or weak, and can store other secrets such as one-time codes and secure notes. The reputable managers are built on encryption that is well understood, and their security model has been publicly documented for years.

Choose one from a well-known provider with a published security model, support for all your devices, and — importantly — two-factor authentication on the vault itself. Turn on that second factor the day you install it, and make your master password a long passphrase you can remember but nobody could guess. Write the master password down on paper and store it somewhere safe at home: losing it can mean losing the vault.

A note on limits: a password manager protects your passwords, but it does not protect you from phishing — it will happily fill your password into a fake site if you navigate there. Two-factor authentication is the layer that catches that case. Use both, and you have a defence that is strong against almost every common attack.

• One long, unique password per account — generated, not remembered.
• Two-factor authentication on the vault itself.
• Master password: a long passphrase, written on paper at home.
• Check the manager's breach alerts and act on them.

Two-factor authentication: the second lock

Two-factor authentication, or 2FA, means signing in needs something you know — your password — plus something you have, such as a code from an app or a security key. With it turned on, a stolen password alone is not enough to get into your account. It is the single highest-value security step after unique passwords, and it should be on your email, banking and social media accounts first.

Not all second factors are equal. A hardware security key or a passkey is strongest, because it cannot be phished. An authenticator app is next best. A code sent by text message is the weakest, because it can be intercepted or tricked out of you by a phone scam — but it is still far better than no second factor at all. Start with whatever your service offers, then upgrade where you can.

Save your recovery codes when you turn on two-factor authentication, and store them somewhere safe — a locked note, or paper at home. They are your way back in if you lose your phone, and losing them at the same time as your phone is the most common way people lock themselves out of their own accounts.

Password habits to drop

Stop reusing passwords, however convenient it is. Stop using personal details — names, birthdays, pet names, favourite teams — because they are the first things an attacker guesses and the easiest to find on social media. Stop writing passwords on sticky notes on your monitor, and stop sharing them in email or chat.

Stop changing passwords on a schedule. The old advice to change your password every 90 days is abandoned by current guidance, because it drove people to make small, predictable changes — adding a number, changing a digit — instead of making a genuinely new password. Change a password when there is a reason: a breach, a phishing attempt, a shared account, or a suspicion it was seen.

Stop using the same password for your email and your banking. If one falls, the other should not. And stop believing that a complex-looking password is automatically safe: an eight-character password with symbols is far weaker than a fifteen-character passphrase of ordinary words.

A practical setup, in one afternoon

Here is a realistic plan. First, install a password manager from a reputable provider and turn on two-factor authentication for the vault. Second, change your email password to a long, unique one, and turn on two-factor authentication for your email. Third, change your banking and payment passwords the same way. Fourth, work through your other important accounts — social media, shopping, cloud storage — changing each to a generated, unique password.

Fifth, check whether your passwords have appeared in known breaches, using a safe k-anonymity checker that never sends your full password anywhere — our guide on checking if your password was leaked explains how this works and what to do with the answer. Finally, write down your recovery codes and your master password, store them safely at home, and tell one trusted person where they are in case of emergency.

That afternoon buys you years of protection. Passwords will eventually be replaced by passkeys for many services, but until then, a manager, unique passwords, and two-factor authentication are the strongest defence an ordinary person can build.

Sources

• NIST — SP 800-63B Revision 4, Digital Identity Guidelines — last checked 14 November 2026.
• National Cyber Security Centre (UK) — Password guidance — last checked 14 November 2026.
• CISA — Cybersecurity best practices — last checked 14 November 2026.

Last checked: 14 November 2026.

Frequently asked questions

How long should a password be in 2026?

Current NIST guidance, SP 800-63B Revision 4 (July 2025), requires a password used on its own to be at least 15 characters long, and allows as few as 8 characters when the password is only one factor of multi-factor sign-in. Services must accept at least 64 characters.

Are complex passwords with symbols still recommended?

No. NIST Revision 4 says services should not impose composition rules, because forced symbols mostly made passwords harder for people without making them much harder for attackers. Length — a long passphrase of random words — matters far more.

Should I change my password every 90 days?

No. Current guidance says services should not require periodic changes. Change a password when there is a reason: a breach, a phishing attempt, a shared account, or evidence it was compromised.

Is a password manager safe?

A reputable password manager encrypts your passwords in a vault locked by one master password, and generates long, unique passwords for every account. Turn on two-factor authentication for the vault, and store your master password and recovery codes safely on paper at home.

What is the most important password habit?

Uniqueness. Give every account its own password, starting with your email — because access to your email lets an attacker reset almost everything else. A password manager makes this practical.