Is it safe to store all my passwords in one manager?

Yes, for almost everyone. A reputable manager encrypts your vault locally with a key derived from your master password, so the provider can't read it. The risk of one well-protected vault is considerably lower than the near-certain risk of password reuse without one.

How long should my password be?

At least 12 characters, and 16 or more where the site allows it. Since your manager generates and stores them, there's little reason to use the minimum.

Should I change my passwords regularly?

No — current NIST guidance advises against scheduled rotation, because it drives predictable incrementing. Change a password when there's a specific reason to.

Is SMS two-factor authentication worth using?

It's much better than nothing and worse than the alternatives. SMS codes can be intercepted through SIM-swapping. Use an authenticator app or hardware key where offered, and SMS where it's the only option.

A cryptographic credential stored on your device that replaces the password entirely — you authenticate with a biometric or PIN and the device proves it holds the key. There's nothing to phish and nothing to reuse, which addresses both of the dominant attacks.

Practical password security, without the folklore

Security8 min readPublished 17 September 2026

Most password advice people carry around dates from the mid-2000s and has since been formally withdrawn by the organisations that issued it. Forced quarterly changes, mandatory symbol requirements, and complexity rules that produce Password1! have all been reversed in current guidance.

This guide covers what current practice actually recommends, and — more usefully — how accounts are really compromised, which turns out to have little to do with the strength of the password itself.

How accounts are actually broken into

Brute-forcing a strong password is rare. It's slow, it's noticeable, and rate limiting makes it impractical against any competently built service. The three mechanisms that account for the overwhelming majority of real compromises are entirely different.

Credential stuffing: an attacker takes username and password pairs leaked from one breached site and tries them everywhere else. This works because people reuse passwords, and it works regardless of how strong the password is.
Phishing: you type your password into a convincing fake. Strength is completely irrelevant — you handed it over.
Malware and info-stealers: software on your device reads saved credentials or keystrokes directly.
Notice what those have in common. In none of them does the length or complexity of the password make any difference at all.

What that means for priorities

If reuse and phishing are the actual threats, then uniqueness and second factors matter far more than complexity. Ranked by how much real risk they remove:

Use a unique password for every account. This alone neutralises credential stuffing entirely, which is the highest-volume attack by a wide margin.
Turn on multi-factor authentication, preferring an authenticator app or hardware key over SMS. A stolen password becomes insufficient on its own.
Use a password manager. It is the only realistic way to hold dozens of unique passwords, and it also defends against phishing — it won't autofill on a lookalike domain, which is a better detector than human vigilance.
Protect your email account above everything else. Whoever controls it can reset every other account you own.
Make passwords long. This matters, but it matters less than the four items above, which is the opposite of how most advice is ordered.

Length beats complexity, by a lot

Adding a character multiplies the search space by the size of the alphabet. Adding a character type only expands that alphabet. Because the effect of length is exponential and the effect of complexity is linear, length wins decisively.

A 16-character lowercase-only password has a larger search space than a 10-character password using every symbol on the keyboard. Complexity requirements also have a well-documented perverse effect: forced to add a capital, a number and a symbol, people produce Password1! — which is both irritating to type and among the first things any cracking dictionary tries.

Password	Character set	Search space
8 chars, all types	~95 characters	~6 × 10¹⁵
12 chars, all types	~95 characters	~7 × 10²³
16 chars, lowercase only	26 characters	~4 × 10²²
16 chars, all types	~95 characters	~9 × 10³¹
4 random dictionary words	~7,776 word list	~4 × 10¹⁵

Search space is a ceiling, not a guarantee — it only applies if the password is genuinely random. A memorable phrase you chose yourself has a small fraction of the entropy the arithmetic suggests.

Why scheduled password changes were dropped

NIST's own guidance reversed on this in 2017, and most other standards bodies followed. The reasoning is behavioural rather than mathematical: when people are forced to change a password every 90 days, they don't generate a new random one. They increment — Summer2025!, Autumn2025!, Winter2025! — which is trivially predictable to anyone who has seen one of them.

Forced rotation also encourages writing passwords down in insecure places and choosing weaker passwords, since they'll be discarded soon anyway. Current guidance is to change a password when there's a reason: a breach notification, a shared device, a suspicion of compromise. Not on a calendar.

Passphrases, and where they belong

Four or five genuinely random words give strong entropy while remaining memorable and typable. They are the right choice for the small number of passwords you must enter by hand — your device login, your password manager's master password, a disk encryption key.

The word doing the work is random. Words you picked yourself, a song lyric, or a familiar phrase carry a fraction of the entropy, because attackers use those wordlists too. Generate them with dice or a tool rather than choosing them. Everything else should be long random strings you never need to remember, stored in a manager.

The remaining habits worth having

Check whether your addresses appear in known breaches, and change anything reused when they do.
Treat security questions as additional passwords — your mother's maiden name is often public. Store a random string as the answer.
Never enter credentials from a link in an email. Navigate to the site yourself; this single habit defeats most phishing.
Prefer authenticator apps or hardware keys to SMS codes, which are vulnerable to SIM-swapping.
Save your recovery codes somewhere offline. Losing access to your second factor with no recovery path is a common and miserable failure.
Don't share passwords over chat or email. Most password managers have a proper sharing mechanism.

Frequently asked questions

Is it safe to store all my passwords in one manager?: Yes, for almost everyone. A reputable manager encrypts your vault locally with a key derived from your master password, so the provider can't read it. The risk of one well-protected vault is considerably lower than the near-certain risk of password reuse without one.
How long should my password be?: At least 12 characters, and 16 or more where the site allows it. Since your manager generates and stores them, there's little reason to use the minimum.
Should I change my passwords regularly?: No — current NIST guidance advises against scheduled rotation, because it drives predictable incrementing. Change a password when there's a specific reason to.
Is SMS two-factor authentication worth using?: It's much better than nothing and worse than the alternatives. SMS codes can be intercepted through SIM-swapping. Use an authenticator app or hardware key where offered, and SMS where it's the only option.
What's a passkey?: A cryptographic credential stored on your device that replaces the password entirely — you authenticate with a biometric or PIN and the device proves it holds the key. There's nothing to phish and nothing to reuse, which addresses both of the dominant attacks.