The old password advice is outdated

For years, the standard advice was simple: use a strong password with uppercase letters, lowercase letters, numbers, and special characters. Make it at least eight characters. Change it every 90 days. Don't write it down.

That advice was well-intentioned, but much of it is now outdated — and some of it actually makes people less secure. Mandatory complexity rules lead to predictable patterns ("P@ssw0rd1!"). Frequent rotation leads to minor variations ("Summer2025!" becomes "Fall2025!"). And telling people not to write passwords down pushes them toward reusing the same password everywhere.

In 2026, the threat landscape has evolved, and our defenses need to evolve with it. Here's what actually works.

Why length beats complexity

The math is straightforward. A password's strength is determined by the number of possible combinations an attacker must try. Length contributes far more to this than complexity.

Consider these examples:

8 characters, full complexity (uppercase, lowercase, numbers, symbols from a 95-character set): 95^8 = approximately 6.6 quadrillion combinations
16 characters, lowercase letters only (26-character set): 26^16 = approximately 43.6 sextillion combinations

The longer, simpler password is roughly 6.6 million times harder to crack through brute force than the shorter, complex one.

This is why NIST (the National Institute of Standards and Technology) updated their guidelines to recommend long passphrases over complex short passwords. A passphrase like "correct-horse-battery-staple" is far stronger than "Tr0ub4dor&3" — and far easier to remember.

The current best practice:

Minimum 16 characters for important accounts
Passphrases of 4-6 random words are both strong and memorable
Complexity is nice to have, but length is the priority

Password managers are non-negotiable

The average person has over 100 online accounts. It is cognitively impossible to remember a unique, strong password for each one. This is why password reuse is so rampant — and why credential stuffing attacks (where attackers try breached password/email combinations across other services) are so devastatingly effective.

A password manager solves this completely. It generates, stores, and auto-fills a unique, random password for every account. You only need to remember one strong master password.

Recommended password managers in 2026

Bitwarden — Open-source, free tier available, audited, cross-platform. The best choice for most people.
1Password — Polished user experience, excellent family and team plans, strong security track record.
KeePassXC — Fully offline, open-source, no cloud dependency. Best for maximum control.
Apple Passwords — Built into iOS/macOS, now available as a standalone app. Convenient for Apple-only households.
Google Password Manager — Built into Chrome and Android. Convenient but locks you into the Google ecosystem.

The best password manager is the one you'll actually use. If you're currently reusing passwords across services, any password manager is a massive security upgrade.

What about your master password?

Your master password is the single most important password you have. Make it a long passphrase (6+ words), don't use it anywhere else, and consider writing it down and storing it in a physically secure location (a home safe, a sealed envelope in a bank deposit box). This is one case where writing a password down is the right call — the risk of losing access to your entire vault outweighs the risk of physical theft.

Passkeys: The future is already here

Passkeys are the most significant advancement in authentication since the invention of the password, and they're rapidly becoming mainstream. Major services including Google, Apple, Microsoft, Amazon, PayPal, GitHub, and many others now support passkey sign-in.

How passkeys work

A passkey is a cryptographic key pair. The private key stays on your device (phone, laptop, or hardware key) and never leaves it. The public key is stored by the service. When you sign in, your device proves it holds the private key through a cryptographic challenge — no password is transmitted, and there's nothing for an attacker to phish or steal from a server breach.

You authenticate locally using your device's biometric sensor (fingerprint or face), a PIN, or a hardware security key. It's simultaneously more secure and more convenient than a password.

Why passkeys are better than passwords

Phishing-proof — Passkeys are bound to the specific website domain. A fake login page can't trick your device into authenticating.
Breach-proof — Even if a service's database is compromised, there's no password hash to crack. The public key alone is useless.
No reuse problem — Each passkey is unique to the service, by design.
Nothing to remember — Authentication is handled by your device.

What to do now

Enable passkeys on every service that supports them. Start with your Google account, Apple ID, and Microsoft account. Check passkeys.directory for an up-to-date list of services that support passkey authentication.

For services that don't yet support passkeys, your password manager remains your best line of defense.

Multi-factor authentication: Not all methods are equal

Multi-factor authentication (MFA) adds a second verification step beyond your password. But the security benefit varies enormously depending on which method you choose:

Tier 1: Strongest

Hardware security keys (YubiKey, Google Titan) — Phishing-resistant, can't be intercepted remotely
Passkeys — Cryptographically bound to the legitimate site

Tier 2: Strong

Authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) — Generate time-based codes on your device. Not phishing-proof, but immune to SIM swaps

Tier 3: Better than nothing

SMS codes — Vulnerable to SIM swap attacks, SS7 network exploits, and social engineering of carrier employees. Still better than no MFA at all, but should be replaced with a stronger method where possible

Tier 4: Weakest

Email-based codes — Only as secure as your email account. If an attacker has access to your email, this provides zero additional protection

The priority: enable MFA on every account that supports it, using the strongest method available. Your email account deserves the strongest protection of all — it's the master key that can reset passwords on everything else.

Checking your passwords against breach databases

Over 14 billion accounts have been compromised in known data breaches. If any of your passwords appear in these breaches, they're effectively public knowledge and should be changed immediately — even if the password seems strong.

How breach checking works (and why it's safe)

You might wonder: is it safe to submit my password to a breach-checking service? With properly designed services, yes — thanks to a technique called k-anonymity.

Here's how it works:

Your password is hashed locally on your device (converted to a fixed-length string using SHA-1)
Only the first 5 characters of the hash are sent to the server
The server returns all known breached hashes that start with those 5 characters (typically several hundred)
Your device checks locally whether your full hash appears in the returned set

The server never sees your password. It doesn't even see your full password hash. It has no way to determine which of the hundreds of returned hashes (if any) is yours. This is the approach used by Have I Been Pwned and integrated into PrivacyChecker.

Check if your passwords have been compromised →

A practical action plan for 2026

Here's what to do right now, in priority order:

Install a password manager and start migrating your accounts. Begin with your most sensitive accounts (email, banking, social media).
Enable the strongest MFA available on your email account, then your financial accounts, then everything else.
Enable passkeys on every service that supports them.
Check your email and passwords against breach databases using PrivacyChecker and change anything that's compromised.
Set a SIM PIN with your mobile carrier to protect against SIM swap attacks.
Audit your existing passwords — your password manager's built-in audit tool will flag weak, reused, and compromised passwords.

The password isn't dead yet — but it's being replaced

Passwords will be with us for years to come, but the trajectory is clear: passkeys and biometric authentication will gradually replace passwords for most services. In the meantime, the combination of a password manager, strong MFA, and regular breach monitoring gives you a defense that's far ahead of what most people have.

Check your accounts for breaches →