What actually protects an account in 2026 — length over complexity, unique passwords, second factors, passkeys, and what to do after a breach.
7 guides
Most password advice is a decade out of date. The current guidance from NIST and the NCSC is shorter, simpler, and contradicts almost everything you were taught about symbols, capitals and changing your password every ninety days.
Any second factor is a large improvement over none, but they are not equivalent. SMS codes can be intercepted, app codes can be relayed by a live phishing proxy, and only hardware keys and passkeys resist phishing outright.
Reusing a password means your security is set by the least careful company you ever signed up to. It is the single behaviour that converts an unrelated breach into a break-in on your accounts.
Credential stuffing is not password guessing. It is taking email-and-password pairs already leaked from one service and trying them, automatically, on hundreds of others — which works because people reuse passwords.
A passkey is a cryptographic key your device holds instead of a secret you know. Because there is nothing to reveal, there is nothing to phish — which makes it the first authentication method that removes the problem rather than managing it.
The objection to password managers is that they put every password in one place. The answer is that the realistic alternative is not perfect memory — it is reusing six passwords across two hundred accounts.
Length beats complexity, uniqueness beats both, and the character-substitution tricks you were taught do essentially nothing. Here is what current NIST and NCSC guidance actually asks for.