The old advice for passwords was wrong in almost every direction it pointed. Write them on paper. Change them every 90 days. Mix in symbols and capital letters until they’re unmemorable. Every one of those was standard guidance for years, and every one of them is now actively discouraged by the people who set the actual standards.
Here’s what NIST’s current guidance (SP 800-63B-4) and the platforms you actually log into every day recommend instead.
What Changed: The Short Version
Length matters more than complexity. A long passphrase beats a short password stuffed with symbols, and forcing “P@ssw0rd1!” style substitutions just makes passwords harder to remember without making them meaningfully harder to guess, attackers know the substitution patterns too. Forced periodic password changes are no longer recommended unless there’s actual evidence of a breach, since routine forced rotation mostly just pushes people toward small, predictable variations of their last password. And screening new passwords against known breached-password databases is now a real, recommended safeguard, not something only enterprise security teams think about.
Passphrases: The Practical Middle Ground
If you’re creating a password yourself rather than letting a generator do it, a passphrase of four to seven random, unrelated words is the current recommendation, and it’s genuinely easier to use than it sounds.
Weak: BlueSky123!, short, predictable, exactly the kind of substitution pattern crackers check for first.
Strong: CoffeeToasterGalaxyRunning, long, high in actual entropy, and easy to type without needing to remember a special-character pattern.
The random-word approach works because it plays to how memory actually functions. Nobody reliably remembers a string like Xk9#mQ2$vL, but a strange, vivid image made of four unrelated words sticks.
Why a Password Manager Beats Paper
The honest correction here: writing passwords on paper used to be defensible advice, and it’s not anymore. Not because paper became less secure, but because password managers now do everything paper can’t.
A password manager generates truly random, unique passwords for every account, something humans are genuinely bad at doing themselves. It autofills them so you’re never typing a password into a phishing page by habit, and it syncs across devices. It can also actively screen your existing passwords against known data breaches to flag which ones need changing now.
Paper does none of that. It also doesn’t help with the biggest risk most people actually carry: reusing the same password across multiple accounts. If one of those accounts leaks, every other account sharing that password is exposed the same day, something a password manager makes trivially easy to avoid by generating a different one for everything.
Passkeys: Where Authentication Is Actually Heading
Passkeys remove the password from the equation entirely. Instead of a secret string an attacker could steal or a phishing page could capture, a passkey uses your device’s biometrics or PIN to unlock a cryptographic key pair, which means there’s no secret in transit for anyone to intercept in the first place.
As of 2026, passkeys are supported broadly across major platforms, iOS 16 and newer, macOS Ventura and newer, Android 9 and newer, and Windows 11, and across every major browser. Google, Microsoft, Apple, Amazon, PayPal, and GitHub all support signing in with a passkey directly. Where a service offers one, it’s currently the strongest, most phishing-resistant option available, stronger than any password, however long.
Multi-Factor Authentication, and Why SMS Isn’t the Good Version
A password alone, even a strong one, is one leaked database away from being useless. Multi-factor authentication is the safety net, but not all versions of it are equal. SMS-based codes are better than nothing, but they’re vulnerable to SIM-swapping attacks, where an attacker convinces your carrier to move your number to their device. An authenticator app (Google Authenticator, Authy, or your password manager’s built-in option) or a hardware key is meaningfully more secure and doesn’t depend on your phone carrier’s own security practices.
Habits Worth Dropping
A few pieces of once-standard advice that current guidance actively moves away from:
- Writing passwords on paper, superseded by password managers, which do everything paper does plus generation, autofill, syncing, and breach screening
- Forced password changes on a schedule, no longer recommended without evidence of an actual breach, since it mostly produces predictable small variations
- Predictable character substitutions (
@fora,0foro), well-known enough to attackers that they add far less protection than they used to feel like they did - Reusing one password across multiple sites, still one of the single biggest risks, and the easiest one to fix with a manager generating a unique password per account
Questions People Ask About Password Security
Are password managers actually safe to trust with everything?
Reputable password managers use end-to-end encryption, meaning the company running the service can’t read your stored passwords even if their servers were breached. The real risk is a weak master password, which is why the master password itself deserves to be your longest, most unique passphrase, protected with MFA.
Should I still use special characters and capital letters in my passwords?
They’re not harmful, but current guidance treats length as the more important factor. A long passphrase without forced substitutions is generally stronger and easier to actually remember than a short password with symbols crammed in to satisfy an old complexity rule.
How often should I actually change my passwords?
Only when there’s a reason to, a known breach, a leaked credential, or if you’re still reusing an old password across multiple accounts. Routine forced rotation on a schedule is no longer recommended, since it tends to produce weaker, more predictable passwords over time rather than stronger ones.
Is SMS-based two-factor authentication good enough?
It’s better than no second factor at all, but it’s vulnerable to SIM-swapping attacks. An authenticator app or a hardware security key is a meaningfully stronger choice when a service offers it as an option.
What’s a passkey, and is it actually different from a password?
Yes, genuinely different. A passkey replaces the password entirely with a cryptographic key pair unlocked by your device’s biometrics or PIN, so there’s no secret string for a phishing page or a database breach to expose. It’s currently the most phishing-resistant sign-in method available on major platforms.
What’s the single biggest password mistake people still make?
Reusing the same password across multiple accounts. If one service leaks that password, every other account sharing it is exposed the same day. A password manager generating a unique password per account is the simplest fix.
Conclusion
Almost everything that used to count as good password advice, memorize it, don’t write it down, change it often, stuff it with symbols, has been replaced by guidance that’s both more secure and considerably less annoying to actually follow. A password manager, a long passphrase or a passkey where one’s offered, and real multi-factor authentication cover more ground than any amount of manual discipline ever did. The goal was never complexity for its own sake. It was making an account genuinely hard to break into, and that’s a different thing entirely.
