Password rules were written when a cracker checked a thousand candidates per second and the main threat was a floppy disk from someone else's hands. Almost everything has changed since; the advice has not — and some of it now does harm.
Myth 1. Passwords must be changed monthly
Passwords must be changed monthly
The only piece of advice officially recognised as harmful. Someone forced to change a password by the calendar does not invent a new one — they append a digit to the old one.
The most persistent belief and the only one officially recognised as harmful. Someone forced to change a password by the calendar does not invent a new one — they append a digit to the old one.
Do not require users to change passwords on a schedule. Scheduled changes make people choose predictable modifications of passwords they already have.
NIST SP 800-63B, digital identity guidelines
Instead: change on an event — a breach, someone with access leaving, a suspicion of compromise. More in password policy.
Myth 2. Special characters are mandatory
Special characters are mandatory
The “capital, digit and symbol” rule produces “Password1!” — formally compliant, actually terrible. Length decides more than the character set.
The “capital, digit and symbol” requirement produces “Password1!” — formally compliant, actually terrible. People place symbols predictably: capital first, digit and exclamation mark at the end.
Instead: length. Twenty letters and digits beat twelve with symbols — and are twice as easy to type.
Myth 3. Never write passwords down
Advice from an era when the threat was a colleague peering into your desk. Today your password is guessed from another city using a leaked database, and a piece of paper in a drawer is out of reach.
Instead: write them down, but sensibly. A password manager for everything, paper for the master password next to your documents. The danger is not writing it down but a sticky note on a monitor in an open office.
Myth 4. Nobody wants my password
You are not chosen. A database of a million credential pairs is taken and replayed across hundreds of sites automatically. Whoever reused a password gets caught — indiscriminately.
Myth 5. The padlock means the site is genuine
It only means the channel is encrypted. A certificate for a fake domain is free and takes five minutes, and most phishing pages run over HTTPS. See the signs of phishing.
Myth 6. Two-factor protection is inconvenient
An objection from the days when the code arrived only by SMS and got lost while roaming. Today an app shows the code without a network, and trusted devices do not ask every time.
Reality: three extra seconds once a month, against the only measure that still works after a password has leaked.
Myth 7. A passphrase is weaker than a random password
It depends on the number of words. Seven random words give about 77 bits — roughly the same as twelve random characters. What matters is that a generator picks the words: a phrase a human invents is markedly weaker. Full comparison.
Myth 8. The browser stores passwords safely
More safely than a text file, but the browser vault has two weaknesses: the passwords are available to anyone at an unlocked computer, and they are tied to one browser. A malicious extension sees them too.
Myth 9. A break-in is immediately obvious
The opposite: whoever gained access wants quiet. The longer you fail to notice, the more they achieve — which is why the signs of a break-in have to be looked for deliberately.