Password Security: Best Practices for 2026 and Beyond

The 2024 update to NIST Special Publication 800-63B quietly retired most of the password advice you grew up with. The new guidance says you should stop forcing users to include special characters, stop requiring periodic password resets, and start screening new passwords against known compromised lists. The reason is empirical: when users are forced to add an exclamation mark or replace letters with numbers, they produce predictable patterns like Password1! that fall to dictionary attacks just as fast as simpler passwords. What actually matters is length. A 16-character passphrase made of unrelated words has more entropy than an 8-character string with every complexity rule applied. Modern guidance also encourages password managers as part of the solution rather than fighting against them. The bottom line is to drop the composition rules, raise the minimum length to at least 12 characters, and focus on what attackers actually do rather than what makes passwords look secure.

Passphrases are the simplest way to combine strength and memorability. A phrase like "river-mango-tractor-window" has around 60 bits of entropy yet is straightforward for a human to remember and type. Compare that with "Tr0ub4dor&3", which is famously hard to remember, easy to mistype, and offers less actual entropy than the passphrase. The math favors longer passphrases because each additional word multiplies the search space by the size of the dictionary, while short passwords only multiply by a much smaller set of characters. For accounts that you log into by typing, especially on mobile keyboards, passphrases win on every axis: stronger, easier to remember, and less frustrating. The trick is choosing words that are unrelated to each other and to your personal life, so an attacker who knows your hobby cannot guess them through context.

A password manager is no longer optional for anyone with more than a handful of accounts. Tools like Bitwarden and 1Password generate a unique, long, random password for every site, store them in an encrypted vault, and fill them in automatically. The only password you need to remember is the master password, which should itself be a strong passphrase. The major objection, the worry about "what if the manager gets hacked?", is real but overstated. Reputable managers encrypt the vault on your device before it ever syncs, so a breach of the server exposes only encrypted blobs. The alternative, reusing a few memorable passwords, is far more dangerous because one site breach puts every other account at risk. If you have not used a manager before, start with a free tier, import your existing logins, and gradually replace reused passwords as you encounter them.

Credential stuffing is the attack that turns one breach into many. Attackers take leaked username and password pairs from one compromised site and try them on hundreds of others. Because reuse is so common, the success rate is shockingly high. Even a strong password, if reused, becomes weak the moment any service you used it on gets breached and the hash is cracked. The defense is mechanical: never reuse passwords across accounts, especially not for email, banking, or your password manager. Two-factor authentication helps a great deal by blocking the attack even when the password matches, but it is not a substitute for unique credentials. If you have reused passwords in the past, prioritize the high-value accounts first, then work through the rest. Most password managers can flag duplicates for you.

Two-factor authentication adds a second proof of identity beyond your password, and it blocks the vast majority of automated account takeover attempts. Not all second factors are equal, however. SMS-based codes are the weakest option because they are vulnerable to SIM swapping, interception, and SS7 attacks. Time-based one-time passwords, generated by apps like Authy, 1Password, or Aegis, are stronger because they live on your device and never travel over the network. Hardware security keys like YubiKey are stronger still, as they resist phishing by verifying the domain you are logging into. Wherever a service supports it, prefer TOTP or hardware keys over SMS. The small inconvenience of typing a six-digit code is well worth blocking the kind of automated attacks that compromise millions of accounts every year.

The simplest way to know whether a password has already been exposed is to check it against the Have I Been Pwned database. The service offers a k-anonymity API: you send only the first five characters of the password's SHA-1 hash, and HIBP replies with a list of matching hash suffixes along with how many times each has appeared in a known breach. Because you only ever send a partial hash, the server never learns your actual password. Most password managers can perform this check automatically and warn you when a stored password appears in a breach. The same database powers breach alerts built into Chrome, Firefox, and Safari. If you find one of your current passwords in the list, change it everywhere you have used it, and do not reuse the new one anywhere else.

When you use an online password generator, the most important property is that the random bytes are produced on your device and never sent over the network. A surprising number of free generators run on the server and could log every password they create. Before using one, check the page source or the privacy policy to confirm it is client-side only. Other useful properties include adjustable length, the ability to exclude ambiguous characters like l and 1 or O and 0, and support for different character sets such as alphanumeric, diceware, or hex. If you are generating a password that you will store in a manager anyway, aim for at least 16 random characters. For passphrases, four or five unrelated words from a large wordlist strike a good balance between strength and usability.