The short version
Government security agencies in the United States and the United Kingdom agree on the core of password advice, even if they phrase it differently. A good password is long, hard to guess and used for one account only. Remembering dozens of those is unrealistic, so both recommend letting a password manager or your browser store them. And where a service offers a passkey, which replaces the password with a cryptographic key kept on your device, that removes several of the ways passwords are stolen.
How passwords get misused
It helps to know what you are defending against. In broad terms, a password can be guessed, tricked out of you, or taken from somewhere it was stored. Guessing is helped by short or predictable choices. Trickery is the business of phishing, covered in the phishing explainer. And when a service suffers a breach, the passwords taken from it may be tried on other services, in the hope that people have reused them.
That last point is why reuse is so damaging. A strong password used on ten sites is only as safe as the weakest of those ten. Length and randomness defend against guessing; uniqueness limits the damage when one site fails through no fault of yours.
Long and unique beats clever
CISA's Secure Our World guidance describes a strong password as long, random and unique. It suggests at least 16 characters, made either of a random mix of letters, numbers and symbols or of a passphrase of several unrelated words, and different for every account.
The UK National Cyber Security Centre recommends a closely related approach: join three random words to make a password that is long enough to be strong but still memorable, and use a strong, separate password for your email account in particular. Email deserves special care because the password-reset links for most of your other accounts are sent there; whoever controls your inbox can often take over the rest.
The two pieces of advice point the same way. What they both move away from is the familiar habit of taking a short word and decorating it with a capital letter, a digit and an exclamation mark. Those substitutions are predictable, so they add less strength than they appear to, and they make passwords harder for people to remember.
Example
Three random words in the NCSC style might look like lantern cobalt pickle, typed with or without spaces depending on what the site allows. This one is printed on a public web page, so it should never be used. The point is the shape: several unrelated words, chosen at random rather than from a phrase or a song you like.
Password managers
Long, unique passwords for every account are only practical if something remembers them for you. Both CISA and the NCSC recommend a password manager. The NCSC's guidance notes that this can be the one built into your browser or device, or a separate app, and that saving passwords this way makes it easier to use a different strong password everywhere.
A password manager is itself protected by a main password or by your device's unlock method, so that one login deserves the most care: make it long and unique, and protect it with a second factor as described in the multi-factor authentication explainer. Managers bring a second benefit that is easy to overlook: they fill passwords in only on the site they were saved for, so a look-alike scam site may not get an automatic fill. That is a useful warning sign, not a guarantee.
This site does not recommend any particular product. What matters is that the manager you choose comes from a trustworthy source, is kept updated and is protected by a strong main login.
What services are told to do
Some of the frustration people feel about passwords comes from the rules websites impose. The US National Institute of Standards and Technology publishes digital identity guidelines that many organisations follow. Its current authentication volume, SP 800-63B-4, sets out how services that check passwords should behave, and it is more user-friendly than many people expect. Among its requirements and recommendations, paraphrased:
- Services should set a reasonable minimum length, which is higher (15 characters) when a password is the only thing protecting an account, and should accept long passwords of at least 64 characters.
- Services should not impose composition rules such as demanding a mix of character types.
- Services should not force people to change passwords on a fixed schedule, but should require a change when there is evidence a password has been compromised.
- Services should check new passwords against lists of ones known to be common, expected or already compromised.
- Services should allow password managers and pasting, so people are not pushed toward short passwords they can type from memory.
These rules are addressed to the organisations running the login page, not to you. But they explain why advice has shifted: forced regular changes and symbol requirements tended to produce predictable passwords, while length and uniqueness hold up better. If a site still imposes old-style rules, follow them, but build the password around length.
Passkeys
A passkey is a different way of signing in that does not involve a password at all. The FIDO Alliance, the standards body behind the technology, describes passkeys as credentials based on public key cryptography. In simple terms, your device creates a pair of keys for each account. The public key is stored by the website; the private key stays with you, protected on your device, and is unlocked with the same thing you use to unlock the device, such as a fingerprint, face scan or PIN.
Signing in then becomes a matter of your device proving it holds the private key, without sending that key anywhere. This changes the risks in useful ways:
- There is no password for a breach to expose, because the website only holds the public key.
- There is nothing to type into a fake site. A passkey is tied to the real website it was created for, which is why it resists phishing.
- There is nothing to remember or reuse.
Many passkeys can be synced between your devices through the account that manages them, so a new phone does not mean starting again. NIST's current guidelines address these syncable authenticators specifically. Passkeys are not yet offered everywhere, and the way you set them up depends on the service and device. Where a service you care about offers one, it is worth considering. Keep your recovery options for that account up to date, because losing all your devices at once is the situation passkeys handle least gracefully.
Where to start
- Give your main email account a long, unique password, and turn on a second factor for it.
- Choose a password manager, either the one built into your device or browser or a separate app, and protect it with a strong main login.
- As you sign in to other accounts over the coming weeks, replace reused or short passwords with new ones the manager generates.
- Where a service offers a passkey, consider switching to it.
- If a service tells you your password was involved in a breach, change it there and anywhere else you used the same one.
Next: Multi-factor authentication: a second lock on your accounts