Password security: what actually matters in 2026

Almost everything most people were taught about passwords is now formally discouraged by the organisations that taught it.

The eight-character minimum, the capital-number-symbol requirement, the ninety-day expiry, the security questions about your first pet — the current guidance from NIST in the United States and the NCSC in the UK either drops these or actively forbids them. Not because the threat got smaller, but because decades of evidence showed these rules made passwords worse by pushing people into predictable behaviour.

Here is what replaced them.

What the current guidance actually says

NIST's SP 800-63B is the document most other password policies eventually copy. Its requirements for anyone operating a login are unusually blunt:

That last one deserves a moment. "What was the name of your first pet?" is a password you cannot change, that you have probably told several hundred people, and that is frequently discoverable from a social media profile. It is now explicitly discouraged as an authentication method.

The three rules that matter

Everything useful about personal password security reduces to three things.

1. Long

The NCSC's recommendation is three random words — applenemobiro in their own example. It produces something long enough to resist guessing and human enough to type, and it sidesteps the trap where "complex" means "one word with substitutions".

Those substitutions, incidentally, do not help. As the NCSC puts it plainly: swapping o for zero is a trick criminals know as well as you do.

2. Unique

This is the one that actually matters, and the one most commonly broken.

A long, strong password used on twelve sites is a long, strong password with twelve chances to leak. When any one of those services is breached, attackers take the leaked email-and-password pairs and try them everywhere else — an attack called credential stuffing, and it is automated, cheap, and extremely effective precisely because reuse is so common.

You can check whether a password of yours already appears in a breach corpus at Have I Been Pwned — a service NIST's own guidance effectively describes when it requires blocklist checking against known compromised values.

3. Protected by a second factor

A password is a single point of failure. Two-factor authentication means that knowing it is not enough.

Not all second factors are equal — an app-generated code is meaningfully stronger than an SMS code, and a passkey or hardware key is stronger still. The comparison of second factors goes through the trade-offs, but the short version is that any second factor beats none by a wide margin.

How to make uniqueness practical

You cannot remember thirty unique fifteen-character passwords. Nobody can. That is not a personal failing, it is the reason reuse is near-universal.

A password manager resolves this by making the secure option the easy one: it generates the password, stores it, and fills it in. You remember one strong passphrase and the manager handles the rest.

It also does something less obvious and rather valuable — it will not autofill your bank credentials on a lookalike domain, because the domain does not match. A password manager is, incidentally, a phishing detector that never gets tired.

Where passkeys fit

Passkeys are the direction the whole field is moving, and they solve the problem at its root rather than managing it.

A password is a secret you know, which means you can be persuaded to reveal it. A passkey is a cryptographic key held by your device. Signing in proves you hold it without ever transmitting anything reusable, and — critically — your device will not offer the passkey to a site with the wrong domain. A perfect replica of your bank's login page gets nothing, because the impersonation that fools you does not fool the cryptography.

Where a service offers passkeys, take them. Where it does not, a long unique password in a manager plus a second factor is the practical equivalent.

What to stop doing

• Stop changing passwords on a schedule. Change them when there is a reason.
• Stop using character substitutions as a substitute for length.
• Stop answering security questions honestly. If a service forces them, treat the answers as additional random passwords and store them in your manager.
• Stop letting the browser's built-in autofill be your only system if it means you never see how many accounts share a password.