Passwords and sign-ins
Length beats complexity: what makes a strong password
For years we were told to use symbols, numbers and capital letters, and to change passwords every few months. The advice has changed.
1 min readExplainer
The short version
A long phrase is stronger and easier to remember than a short password full of symbols, and changing passwords every 90 days is no longer recommended.
What changed
Old password rules produced passwords like Summer2024! that are hard to remember and easy to guess, because everyone makes the same substitutions. Forced changes every 90 days made it worse: people just added a number.
Current US government guidance on digital identity, and most security experts, now recommend:
- Length over complexity. Longer is stronger. Several random words make a password that is both strong and memorable.
- No forced regular changes. Change a password when there is a reason to, such as a breach or a suspected compromise.
- Checking against known breached passwords, so nobody uses one already in attackers’ lists.
- No password hints or security questions that anyone could look up.
What a strong password looks like
A passphrase of four or more unrelated words is a good start: something like copper lantern basket orbit. Avoid song lyrics, quotes and anything about yourself.
The bigger picture
Even a perfect password can be phished or leaked. That is why the two most important habits are:
- A different password for every account, which a password manager makes easy.
- Multi-factor authentication everywhere it is offered.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.