Hackers and identity thieves break into people's accounts and devices by stealing or guessing their passwords. Once they're in, they can cause real misery for the owner.
Keeping them out starts with long, strong and secure passwords. However, the advice on what makes a password strong has changed a lot in the last few years, and some of the tips many of us learnt are now out of date.
Post summary
Why strong passwords still matter
What makes a password strong today
Password managers, two-step verification and passkeys
Securing your mobile devices
Other security measures
Frequently asked questions
Why strong passwords still matter
Stolen passwords remain one of the most common ways into a business. Verizon's 2025 Data Breach Investigations Report found that compromised credentials were the way in for 22% of the breaches it reviewed.
The same research found that credential stuffing, where attackers try passwords leaked from one site on many others, made up a median of 19% of all login attempts each day. That's why reusing a password is so risky. One breach anywhere can open the door everywhere else.
Victims of hacking can lose money, have their bank details stolen or, even worse, have their identity stolen. Hackers can change the victim's passwords, take over their phone, laptop and email, and use their identity to commit crimes that could put the victim in legal trouble.
More devices, more targets
We now use more connected devices than ever, from laptops and smartphones to tablets, smartwatches and smart speakers. Each one stores or accesses personal information, payment details and logins.
More of us also work remotely, often from cafes, co-working spaces and different countries. That makes us more connected, and a bigger target. For how we handle this as a remote team, see our guide on how to forge successful and secure remote team communication.
A password, passcode or passkey is what stands between all that information and anyone trying to misuse it. A password that's hard to crack makes an attack slow and expensive, and with luck the attacker moves on to an easier target.
What makes a password strong today
Length matters more than complexity
For years we were told to mix upper and lower case letters, numbers and symbols. Current guidance puts length first.
The US National Institute of Standards and Technology's digital identity guidelines, updated in August 2025, set a minimum of 15 characters when a password is the only thing protecting an account. They also tell organisations not to force arbitrary rules about character types, and to check new passwords against lists of passwords that have already been leaked.
Use three random words
An easy way to make a long password you can remember is to string together three random words, such as OrbitWalnutPiano. The UK's National Cyber Security Centre has recommended this approach for years, because the result is longer and harder for cracking software to predict than a short, complex password. Don't use that example, of course, and avoid words that link to you, such as a pet's name or a favourite team.
Skip the letter swaps
Many of us were taught to swap letters for numbers or symbols, so "Password" becomes "P@ssw0rd". Cracking software tries these swaps automatically, so they add very little protection. And please never use the word "password" as your password, however cleverly you disguise it.
Never reuse a password
Hackers love it when people use the same password on more than one account. Once they have it, they'll try it everywhere else. Every account needs its own password, which is where a password manager comes in.
| Old advice | What works now | Why |
|---|---|---|
| Swap letters for numbers and symbols | Use a long passphrase, such as three random words | Cracking software already tries common swaps. |
| 10 to 12 characters is enough | Aim for 15 characters or more | It's NIST's minimum when a password is used on its own. |
| Change your passwords regularly | Change them when there's a sign of a breach | Forced changes push people towards small, predictable tweaks. |
| Never write passwords down | Keep them in a password manager | One strong master password protects all the others. |
| The padlock means a site is safe | The padlock only means the connection is encrypted | Fake and phishing sites use HTTPS too. |
| A strong password is enough | Add two-step verification, or use a passkey | A stolen password on its own is no longer enough to get in. |
Password managers, two-step verification and passkeys
Password managers
We need so many passwords that it's tempting to reuse them, write them on a sticky note or keep them in a file on your desktop. All of these can be found and used by someone else.
A password manager solves the problem. It creates a long, random password for every account, stores them in an encrypted vault and fills them in for you. You only need to remember one strong master password. Options include Bitwarden, 1Password and Proton Pass, and Apple and Google build password managers into their devices and browsers.
Many password managers also warn you if one of your passwords appears in a known breach. You can check your email address yourself at Have I Been Pwned.
Two-step verification
Two-step verification, also called two-factor or multi-factor authentication, asks for something extra when you log in, such as a code from an app on your phone. Even if someone steals your password, they can't get in without that second step.
Turn it on for every account that offers it, starting with email, banking and social media. An authenticator app is safer than codes sent by SMS, which can be intercepted.
Passkeys
Passkeys replace passwords altogether. You log in with your fingerprint, face or device PIN, and there's nothing for a hacker to guess, steal or trick you into typing on a fake website.
In April 2026, the National Cyber Security Centre said that passkeys should now be people's first choice of login. Where a service doesn't offer them yet, it recommends using a password manager and keeping two-step verification switched on.
Securing your mobile devices
Your phone probably holds more of your life than your laptop does, so protect it properly.
Use a PIN of at least six digits, or a longer alphanumeric passcode, rather than four digits
Turn on fingerprint or face unlock, so a longer passcode doesn't slow you down
Set your screen to lock after a minute or two of inactivity
Turn on the setting that finds, locks and wipes your phone if it's lost or stolen
Install updates as soon as they arrive, as many fix security flaws
If you get an alert about a login from a device or location you don't recognise, change that password immediately
Other security measures
Passwords, passcodes and passkeys are vital. However, there are other simple checks you can make.
Never share your passwords with anyone, even your spouse. If someone needs access, most password managers let you share a login securely.
Check where you type. Only enter personal and financial details on websites you trust. HTTPS and the padlock in your browser mean the connection is encrypted. However, they don't prove the site is genuine, as phishing sites use them too.
Be wary of links in emails and messages. If a message asks you to log in, go to the website yourself rather than clicking the link.
Keep your software up to date, including your operating system, browser and security software.
How we protect our clients
At Blu Mint, we work with defence companies, governments and political parties, so we take security very seriously. Our team uses Signal for end-to-end encrypted messaging and Cryptee for encrypted document storage, because we know how valuable our clients' information is to the wrong people.
You don't need to work with governments to take the same steps. Long, unique passwords, a password manager, two-step verification and passkeys where you can go a long way to keeping you safe.
-
Aim for at least 15 characters, which is NIST's minimum when a password is used on its own. Three random words is an easy way to get there. A password manager can create longer, random passwords for you.
-
Yes. There's nothing to guess, reuse or type into a fake site, and the UK's National Cyber Security Centre now recommends passkeys as your first choice wherever they're offered.
-
Yes. A password manager creates and stores a unique, strong password for every account, so you only need to remember one. It's far safer than reusing passwords or writing them down.
-
Only when there's a reason to, such as a data breach, a suspicious login alert or if you've shared it by mistake. NIST advises against forcing regular changes, as people tend to make small, predictable tweaks.
