Password rules were written in the years when a cracker tested a thousand guesses per second. Today a single graphics card tests tens of billions, and the main threat is not brute force at all — it is somebody else’s data breach. Here are the rules that genuinely matter in 2026.
1. Length beats exotic characters
Every extra character multiplies the search space by the size of the alphabet. Twenty lowercase letters give 94 bits of entropy; twelve characters with asterisks and brackets give 79. An exclamation mark does not save a short password, but ten more characters do.
The benchmark: 16 characters for an ordinary site, 20 or more for email, banking, your password manager and work accounts. If a service caps the length, take the maximum it allows.
2. A different password for every service
The dominant attack today is credential stuffing: a leaked email-and-password pair is replayed automatically against hundreds of popular sites. One reused password turns a forum breach into the loss of your mailbox, and with it everything else.
Your mailbox is the root key to every account. Give it the longest password you have and mandatory two-factor protection.
3. A password manager instead of memory
Nobody can memorise twenty unique passwords, so people invent a system: a base word plus the site name. Such schemes collapse the moment one password shows up in a breach.
You only need to remember two secrets: your device unlock code and the master password of the manager. A seven-word passphrase is ideal for the second one. Bitwarden, KeePassXC, 1Password or the browser vault keep the rest.
4. Two-factor protection is not optional
A second factor is required for email, banking, government services and work accounts. An authenticator app or a hardware key beats SMS: text codes are intercepted through SIM swapping. Store the backup codes in your password manager — you will need them when the phone is lost.
Check yourself
Tick off what is already done. The list resets on reload — the site remembers nothing about you.
With fewer than five ticks, start with a one-evening audit: it explains how to set priorities and not abandon the job halfway.
5. Do not rotate passwords by the calendar
Mandatory 90-day rotation produces “Summer2026!” → “Autumn2026!”: people make the smallest possible change and predictability grows. Both NIST and most industry standards have dropped the requirement.
Change a password when: the service announced a breach, the password was reused elsewhere, a device was lost, an employee with access left, or you simply suspect compromise.
6. Do not invent randomness in your head
People put the digits at the end, the symbol after the first letter, swap “o” for zero and “a” for an at sign. All of these have been baked into cracking tools as ready-made rule sets for years. “P@ssw0rd!” costs an attacker exactly as much as “password”.
You can test your own habit on the password analysis page — it shows which patterns it recognises in your combination.
7. Share passwords safely
Not by email, not in a messenger, not on a sticky note. Use shared access in a password manager or a one-time link service; and if you must read it out loud, the speaker button next to the generator readout spells it with the radio alphabet.
A five-minute checklist
- Install a password manager and pick one seven-word master password.
- Change your email password to 20+ characters and switch on two-factor protection.
- Find everywhere the old email password was reused and replace it there.
- Turn on two-factor protection for banking, government and work services.
- Store the backup codes in the manager, not in screenshots on your phone.