Password security in 2026: what actually matters now

Password advice used to boil down to two things: make them long, and don't reuse them. That's still true, but the world around passwords has changed enough that the practical checklist looks different in 2026 than it did five years ago. The good news is that most of the changes make life easier for the average person, not harder.

The biggest shift is the arrival of passkeys. A passkey replaces a password with a cryptographic key stored on your device and unlocked with your face, fingerprint, or PIN. There's nothing to remember, nothing to type, and — critically — nothing to phish. Every major platform now supports them, and if a site you use offers a passkey option, take it. It's genuinely more secure than any password you could invent.

For everything else, a password manager is table stakes. The value isn't just in storing passwords; it's in generating a unique random password for every site so that a breach at one service can't cascade to any other. Any modern password manager does this well; the specific choice matters less than the fact that you're using one.

Length beats complexity. A 20-character random string with just lowercase letters is enormously harder to crack than a 10-character mixed-case string full of numbers and symbols. Modern brute force attacks measure their difficulty in bits of entropy, and a longer string wins every time. Aim for 16 characters minimum for anything you generate yourself.

Two-factor authentication is still worth turning on, but the type matters. App-based codes (like Authy or Google Authenticator) are much better than SMS, which is vulnerable to SIM-swap attacks. Hardware keys like YubiKey are better still. Reserve them for your most important accounts — email and password manager, especially.

Some advice that used to matter no longer does. Forced rotation every 90 days is now discouraged by NIST because it leads people to pick weaker, more predictable passwords. Complex composition rules ('must include an uppercase and a symbol') are similarly out of favour. Length and uniqueness matter far more than character variety.

One category of threat is more dangerous now: phishing. Attackers use AI to generate convincing emails, cloned login pages, and even voice calls impersonating people you know. The defence isn't a stronger password — it's a habit of never entering credentials via a link in an email, and always navigating to the site directly. Passkeys eliminate this attack entirely because they only work on the real domain.

Password reuse remains the single biggest risk for most people. When a database is breached — and databases are breached constantly — attackers try the leaked email and password combinations on hundreds of other services. If you've used the same password anywhere else, they're in. Check haveibeenpwned.com to see if your addresses have appeared in known breaches; the results are usually eye-opening.

Finally, don't neglect the recovery flow. A strong password on your email is worthless if the password recovery for your bank sends a code to a phone number you no longer own. Audit your recovery emails and phone numbers annually, and remove any that no longer belong to you.