Password Security Best Practices

Password advice has changed substantially over the years, and a lot of outdated guidance is still floating around. Here's what current, evidence-based practice actually recommends.

The one habit that matters most: uniqueness

A single reused password across multiple accounts means a breach at the weakest of those services compromises all of them, regardless of how strong the password itself is. Unique passwords per account is the highest-leverage single habit in this entire list — it single-handedly defeats credential stuffing, one of the most common account-compromise methods.

Use a password manager

Memorizing dozens of unique, strong passwords isn't realistic, which is exactly why password reuse is so common. A password manager generates and stores unique passwords per account, so the only password you need to remember is the one protecting the manager itself — which should be long, memorable to you specifically, and used nowhere else.

Length over complexity

Older guidance emphasized special characters and mandatory complexity rules (P@ssw0rd!) that people satisfied with predictable substitutions attackers now account for automatically. Current guidance favors length: a long passphrase is both harder to crack and easier for a human to remember than a short, "complex" string.

Stop rotating passwords on a schedule

Mandatory 90-day password rotation — once standard advice — is now widely discouraged. In practice, it pushes people toward small, predictable variations of the same password rather than genuinely new ones. Change a password when there's a real reason to: a breach notification, suspected compromise, or a service you no longer trust — not on a calendar.

Multi-factor authentication is not optional

Even a strong, unique password can be phished or leaked. Multi-factor authentication (MFA) — a second factor beyond the password, ideally an authenticator app or hardware key rather than SMS where possible — is what stops a stolen password from being immediately usable. Enable it everywhere it's offered, starting with email, since email is the recovery path for most other accounts.

Watch for breach exposure

Periodically check whether your email or accounts have appeared in known data breaches, and treat any match as an immediate signal to rotate that specific password — especially if it was reused anywhere else.

The short version

Unique password per account, generated and stored by a password manager, long rather than "clever," multi-factor authentication enabled everywhere available, and rotated only when there's an actual reason. That combination addresses the overwhelming majority of real-world account compromise.