Password advice has changed more in the last decade than in the previous thirty years combined. Rules that were considered best practice in the 2000s and 2010s — mandatory special characters, forced 90-day resets, complex substitution patterns like swapping "a" for "@" — have largely been abandoned by the security researchers who originally recommended them, because real-world data showed those rules made passwords easier to guess and harder to remember, not harder to crack. This guide covers what current security guidance actually recommends, why the old rules got quietly retired, and how to build passwords that are genuinely strong without becoming impossible to manage.
For years, the standard advice was: use at least one uppercase letter, one number, one special character, and change your password every 90 days. This advice came from the National Institute of Standards and Technology's original 2003 guidelines, written in part by an engineer named Bill Burr — who later publicly said he regretted much of that guidance once real-world password data showed how people actually respond to complexity rules.
In practice, forcing complexity requirements led people to predictable patterns: capitalizing the first letter, adding "1" or "!" at the end, and reusing the same base password with minor variations across every account. "Password1!" satisfies most complexity rules while being one of the first guesses any password-cracking tool tries. Meanwhile, forced periodic resets led people to make small, predictable changes to existing passwords ("Summer2023!" becoming "Summer2024!") rather than genuinely new ones — and each incremental version was easier to guess once an attacker knew the pattern from a previous breach.
NIST's current guidelines (SP 800-63B) explicitly reversed much of this old advice. Forced periodic password changes are no longer recommended unless there's evidence of compromise. Complexity requirements around specific character types are discouraged in favor of length. The shift reflects a broader understanding: length is the single strongest driver of password strength, and rules that push people toward memorable-but-predictable patterns often reduce real-world security rather than improving it.
Password strength comes down to entropy — essentially, how many possible combinations an attacker would have to try before guessing correctly. Length is the dominant factor. Each additional character multiplies the number of possible combinations, while adding character-type requirements (must include a symbol, must include a number) adds comparatively little entropy once length is already sufficient, and can actually reduce entropy if it pushes people toward predictable substitutions.
A password like correct-horse-battery-staple — four random, unrelated words strung together — is dramatically harder to crack via brute force than something like P@ssw0rd!, despite looking "simpler" at a glance, purely because of its length. This approach, sometimes called a passphrase, has become the standard recommendation from most security researchers because it's both harder to crack and genuinely easier for a human to remember than a string of random characters.
Current best-practice guidance generally recommends:
Even a genuinely strong, hard-to-crack password becomes worthless the moment it's reused across multiple sites — because the real-world way most accounts get compromised isn't through brute-force guessing at all. It's through credential stuffing: attackers take email-and-password combinations leaked from one breached site and systematically try them against hundreds of other popular sites, banking on the fact that most people reuse passwords. If your email and password from some small, poorly secured forum you signed up for years ago gets leaked, and you used the same password for your email account, an attacker doesn't need to crack anything — they just try the leaked combination directly.
This is why uniqueness matters more than most people assume, and why the single highest-leverage security habit is a unique password for every account, no exceptions — including accounts that feel unimportant, because a breach anywhere in your reused password chain compromises everywhere else you used it.
The uncomfortable truth about "use a unique, long, random password for every account" is that no one can memorize dozens of them. This is exactly the problem password managers solve: they generate and store a unique, high-entropy password for every site, so you only need to remember one strong master password (or use biometric/hardware-key unlock) to access all the others.
The security trade-off is concentrating risk into a single master password and a single point of failure — which is why that one password deserves the highest possible strength and should never be reused anywhere else, and why enabling two-factor authentication on the password manager itself is essentially mandatory, not optional.
Even a perfect password strategy has a blind spot: phishing. A sufficiently convincing fake login page can trick even careful people into typing their real password into an attacker's form. Two-factor authentication (2FA) — requiring a second proof of identity beyond the password, like a code from an authenticator app or a hardware security key — closes this gap, because a stolen password alone isn't enough to log in.
Not all 2FA methods are equally strong. SMS-based codes are better than nothing but are vulnerable to SIM-swapping attacks. Authenticator apps (like those generating time-based one-time codes) are meaningfully more secure. Hardware security keys offer the strongest protection available and are increasingly recommended for high-value accounts like primary email and financial services.
A few once-standard practices are now considered outdated or counterproductive by most security researchers:
The fastest, most reliable way to follow all of the above is to let a password generator do the work — producing a genuinely random, sufficiently long password (or passphrase) instantly, with adjustable length and character-set options depending on what a given site requires. Combined with a password manager to store the results and unique passwords for every account, this covers the vast majority of what actually keeps accounts secure in practice, without requiring you to memorize a single complex string.
Counterintuitively, writing passwords on paper kept in a secure physical location (like a locked drawer at home) is considered reasonably safe by many security experts, since it's immune to remote hacking. It's far less safe than a password manager for practical daily use, and clearly unsafe if the paper is left somewhere publicly visible, like a sticky note on a monitor.
Current guidance recommends changing a password only when there's a specific reason to believe it's been compromised — a data breach notification, suspicious account activity, or accidentally sharing it. Mandatory periodic rotation with no evidence of compromise is no longer recommended by most security researchers, since it tends to produce weaker, more predictable passwords over time.
Reputable password managers use strong encryption and are generally considered significantly safer than the alternative of weak or reused passwords across many accounts. The main risk is concentrating access behind a single master password, which is exactly why that master password should be exceptionally strong and protected with two-factor authentication.
Change that password immediately, and change it everywhere else you reused it, if applicable. Consider checking whether your email address appears in known public breach databases, and enable two-factor authentication on the affected account if it isn't already active.
Try the Password Generator — free, instant, no signup
Open Password Generator →This article is for general informational purposes only and isn't professional advice. For decisions involving your health, finances, or legal matters, please consult a qualified professional.