What actually protects an account in 2026 — length over complexity, unique passwords, second factors, passkeys, and what to do after a breach.
11 guides
Most password advice is a decade out of date. The current guidance from NIST and the NCSC is shorter, simpler, and contradicts almost everything you were taught about symbols, capitals and changing your password every ninety days.
Yes - and the reason is specific rather than general. A passkey removes the shared secret that phishing, breaches and credential stuffing all depend on. What it does not remove is account recovery, which is where the remaining risk now sits.
A SIM swap moves your phone number onto a criminal's device. Your phone goes dead, their phone starts receiving your calls, texts and verification codes - and the codes are the point. US carriers must now offer a free lock that blocks it.
A strong, unique password stored in a manager can still end up in criminal hands, because some theft happens on your computer rather than at the company you signed up to. Infostealers copy saved logins and session cookies, and the cookies bypass two-factor entirely.
A breach notice, a browser warning and a Have I Been Pwned hit all mean the same thing - that password is now public and must be retired everywhere. What to do beyond that depends entirely on what else was taken.
Any second factor is a large improvement over none, but they are not equivalent. SMS codes can be intercepted, app codes can be relayed by a live phishing proxy, and only hardware keys and passkeys resist phishing outright.
Reusing a password means your security is set by the least careful company you ever signed up to. It is the single behaviour that converts an unrelated breach into a break-in on your accounts.
Credential stuffing is not password guessing. It is taking email-and-password pairs already leaked from one service and trying them, automatically, on hundreds of others — which works because people reuse passwords.
A passkey is a cryptographic key your device holds instead of a secret you know. Because there is nothing to reveal, there is nothing to phish — which makes it the first authentication method that removes the problem rather than managing it.
The objection to password managers is that they put every password in one place. The answer is that the realistic alternative is not perfect memory — it is reusing six passwords across two hundred accounts.
Length beats complexity, uniqueness beats both, and the character-substitution tricks you were taught do essentially nothing. Here is what current NIST and NCSC guidance actually asks for.