What makes a password secure in 2025 and beyond?

A secure password is long (16+ characters), random (not based on words, names, or patterns), and unique to each account. Length matters more than complexity — "correct-horse-battery-staple" is stronger than "P@ssw0rd". Use a password manager to generate and store unique random passwords for every site. Enable 2FA (two-factor authentication) on all critical accounts regardless of password strength.

How do I know if my password has been compromised?

Check haveibeenpwned.com — it checks your email address against a database of billions of leaked credentials from data breaches. Your password manager may also alert you to breached passwords automatically. If a password appears in a breach, change it immediately on that site and on any other site where you reused the same password (which is why unique passwords per site matter).

What is a passphrase and is it stronger than a traditional password?

A passphrase is a sequence of random words (e.g. "flamingo-umbrella-library-seven") used as a password. A 4-word random passphrase has more entropy than most traditional passwords and is far easier to remember. The key word is random — "ilovemydog" is weak; "flamingo-umbrella-library-seven" is strong. Password managers remove the need to memorize, so using fully random generated passwords is even better.

What is two-factor authentication and should I use it everywhere?

Two-factor authentication (2FA) requires a second proof of identity — a one-time code from an authenticator app, SMS, or hardware key — in addition to your password. Even if an attacker knows your password, they cannot log in without the second factor. Enable 2FA on all accounts that offer it, starting with email, banking, social media, and any account linked to payment methods.

Password Security in 2026: What Actually Protects You (And What Doesn't)

Why the Old Password Rules No Longer Work#

For years, security guidance told users to create passwords with uppercase letters, numbers, and symbols — producing memorable-but-weak passwords like 'P@ssw0rd' and 'Tr0ub4dor&3'. NIST (the US National Institute of Standards and Technology) updated its password guidelines in 2017 and again in 2024, explicitly discarding these rules. The reason: humans are predictable. When forced to add a number, people add it at the end. When forced to use a symbol, they replace 'a' with '@' or 'o' with '0'. These substitutions are well-known to attackers and incorporated into dictionary attack word lists. A password that follows the old complexity rules but is built on a dictionary word is weaker than a random four-word passphrase with no special characters.

How Modern Password Attacks Actually Work#

Modern attackers do not try to guess your password manually — they use automated tools running millions of attempts per second. Dictionary attacks try every word in a language database, plus common substitutions. Credential stuffing uses leaked username/password pairs from previous breaches: if you used 'hunter2' on a breached website, attackers try it on every other service. Rainbow table attacks use precomputed hash-to-password mappings to reverse poorly hashed passwords. Brute force attacks try every possible character combination — feasible for short passwords but not for passwords above 12 characters. The practical implication: password length is the primary protection against brute force; password uniqueness is the primary protection against credential stuffing.

What Actually Makes a Password Strong#

Length is the most important factor. A random 16-character password consisting of any characters is exponentially harder to crack than a carefully constructed 8-character password meeting all the old complexity rules. The current guidance from NIST 2024: minimum 15 characters; allow any Unicode characters; do not impose complexity requirements; do not require regular rotation (rotation leads to predictable patterns like 'Password1!', 'Password2!'); do check against lists of known compromised passwords. A passphrase — four or more random words concatenated — achieves high entropy while remaining memorable: 'correct horse battery staple' has approximately 44 bits of entropy from random word selection. Check any password's strength estimate using the Password Strength Checker at allio.tools/password-strength-checker/.

Password Managers: Why They Solve Every Problem at Once#

The core tension in password security is that the safest passwords are random and unique per service, but humans cannot memorise dozens of random strings. Password managers (Bitwarden, 1Password, KeePassXC, and others) solve this by requiring you to remember exactly one strong master password, then generating and storing unique random passwords for every other service. Security research consistently shows that the largest attack surface is reused passwords — the same password used on multiple sites. A password manager eliminates reuse entirely. Bitwarden is open-source, audited, and free for personal use. Even a simple system — one strong passphrase plus a consistent formula for generating service-specific variations — is vastly better than reusing passwords.

Two-Factor Authentication: The Most Impactful Security Upgrade#

Two-factor authentication (2FA) adds a second verification step beyond your password: typically a time-based one-time code from an authenticator app (Google Authenticator, Authy, Microsoft Authenticator) or a hardware security key (YubiKey). Even if an attacker steals your password through a data breach or phishing, they cannot access your account without the second factor. Google's own research found that adding an authenticator app to a Google account blocks 99.9% of bulk phishing attacks and 97% of targeted attacks. SMS-based 2FA (where the code is sent by text message) is better than no 2FA but vulnerable to SIM-swapping attacks — use an authenticator app where possible. Enable 2FA on every account that offers it, prioritising email, banking, and social media.

Checking Whether Your Credentials Were Compromised#

Have I Been Pwned (haveibeenpwned.com), created and maintained by security researcher Troy Hunt, indexes credentials from over 12 billion accounts exposed in data breaches. Enter your email address to see whether it has appeared in any known breach — and which services were compromised. This is a genuine intelligence service: knowing that your email appeared in a specific breach tells you exactly which password may be in attacker lists. If your email appears, change the password for the affected service immediately, and check whether you used the same password anywhere else. HIBP also has a Pwned Passwords API that checks specific password strings against breach databases — the Password Strength Checker at allio.tools/password-strength-checker/ estimates complexity independently without sending your password anywhere.

Phishing: The Attack That Bypasses Strong Passwords#

The most common way credentials are stolen is not by cracking a strong password — it is by tricking the user into entering their password on a convincing fake website. Phishing emails mimic banks, email providers, package delivery services, and any trusted service. Modern phishing pages are visually identical to legitimate sites. Protection measures: check the full URL in the address bar before entering any credentials — attackers use typosquatted domains (gooogle.com) and subdomains (paypal.account.verify.malicious.com); enable 2FA so a stolen password alone is insufficient; use a password manager, which will refuse to autofill credentials on pages whose URL does not match the stored entry; and be sceptical of any email asking you to click a link and log in, even if it looks legitimate.