I spent years following password rules that made security worse. Change passwords every 90 days, use uppercase, lowercase, numbers, and symbols, never reuse passwords. Under those rules, “Spring2025!” rotating to “Summer2025!” rotating to “Fall2025!” is fully compliant, and that’s exactly the problem: the rules select for compliance, not for unpredictability.

I checked passwords built that way against breach databases anyway, out of habit more than doubt. Every single one appeared in credential dumps available to anyone willing to look. The rules designed to protect me were training me to be predictable.

Traditional Password Rules Create Weak Passwords

The password rules everyone follows:

  • Minimum 8 characters
  • Uppercase + lowercase + number + symbol
  • Change every 60-90 days
  • Don’t reuse passwords

Sound familiar? These rules produce predictable patterns:

  • Capital letter first (human nature)
  • Numbers at the end (easiest place to increment)
  • Common substitutions (@ for a, 0 for o, 3 for e)
  • Seasonal or incremental changes (Spring2025 → Summer2025 → Fall2025)

Attackers know these patterns. Dictionary attacks include them. Brute force tools prioritize them.

Run any breach database against real-world password dumps and the same handful of “compliant” passwords come up over and over: “P@ssw0rd!”, “Welcome123!”, “Summer2024!”. Every one satisfies the complexity rule on paper, and every one shows up by the millions, because “compliant” and “unpredictable” turned out to be two different things. The rule was never wrong about what it demanded. It was wrong about what humans do when handed that demand.

For more on securing your digital identity beyond just passwords, see my guide on leaving Gmail for more secure alternatives.

What Actually Works

Length Beats Complexity

Compare these passwords:

“P@ssw0rd1”

  • 10 characters, meets every complexity rule
  • Roughly 66 bits of entropy if you assume full randomness across the 95-character printable set, but it isn’t random
  • Predictable substitution patterns (@ for a, 0 for o) cut the real search space far more than the character count suggests, and NIST’s own guidance estimates human-chosen passwords this size at well under half that
  • Already sitting in multiple breach dumps; hashcat rule-based attacks catch the rest in hours

A six-word Diceware passphrase

  • No special characters required
  • Entropy comes from word count, not character count: six words off the EFF’s 7,776-word list is about 77 bits
  • Not in any breach database, because it’s generated fresh instead of following a pattern
  • Deep into “not happening on any timeframe that matters” territory, even accounting for future hardware gains

Character count alone doesn’t tell you much. Natural-language strings have far less entropy per character than random ones do, which is exactly why “P@ssw0rd1” looks complex and cracks fast, while a passphrase with no symbols at all doesn’t. Word count against a known wordlist is the number that actually matters.

Check Passwords Against Breach Databases

Over 12 billion credentials have been exposed in data breaches. Your password might already be compromised without you knowing.

Check your passwords:

  1. Visit Have I Been Pwned
  2. Enter your email address
  3. See which breaches exposed your data
  4. Change passwords on those accounts immediately

The site uses k-anonymity - it doesn’t send your actual password, only the first 5 characters of its hash. Your password stays private while checking if it’s compromised.

When I first checked, I found my email in 8 breaches. Accounts I’d forgotten about had exposed credentials years ago. I was still using variations of those passwords everywhere.

Stop Changing Passwords on a Schedule

Forced password rotation every 90 days seems logical. In practice:

  • Users make minimal changes (Password1 → Password2)
  • People write passwords down to remember them
  • Password strength decreases with each rotation
  • Everyone does it on the same schedule (end of quarter)

Better approach: Change passwords when they’re actually compromised:

  • Appears in a new breach database
  • Suspicious account activity
  • You typed it on an untrusted device
  • Service announces a data breach

I stopped rotating passwords on a schedule. Instead, I:

  • Set up breach monitoring alerts
  • Use unique passwords per site (password manager)
  • Change immediately when there’s a reason

Result: Stronger passwords, less frustration, better security.

Use Passphrases, Not Passwords

Skip the “personal facts only you know” advice. Your childhood address, first pet, or where you went to school are also the answers to most security questions, and increasingly they’re sitting in your own social media history, which makes them guessable by exactly the kind of targeted attack a passphrase is supposed to defend against.

Use a wordlist instead. Diceware is the standard approach: roll physical dice (or use a cryptographically random generator) to pick words off the EFF’s public 7,776-word list.

  • gravel orbit lantern thicket canyon bridle: six words, about 77 bits of entropy, no autobiographical trail to reconstruct
  • Add a random word or two if a site’s minimum length forces it

Why this works:

  • Entropy scales with word count against a known list, not with how long the string looks
  • No dictionary attack works against words chosen by dice roll, since there’s no pattern to exploit
  • Nothing about it can be reconstructed from your public profile, unlike a “meaningful” personal phrase

Why people don’t do this:

  • Websites enforce 16-character maximums (bad design)
  • Forms reject spaces (also bad design)
  • People think complexity = security

If a site won’t accept a long passphrase, it has poor security engineering.

Block Common and Compromised Passwords

Some passwords should never be accepted:

Obviously weak:

  • password, 123456, qwerty
  • Company name + year
  • Sports teams
  • Keyboard patterns (asdfgh, qazwsx)

Previously breached:

  • Any password in breach databases
  • Leaked credential lists
  • Common password dumps

When creating a password, services should check:

  1. Is it longer than 12 characters?
  2. Does it appear in breach databases?
  3. Is it a known common password?

If yes to #2 or #3, reject it. Length requirement prevents brute force, breach checking prevents credential stuffing.

Multi-Factor Authentication: The Essential Layer

Passwords alone aren’t enough. Even a strong password can be phished, keylogged, or shoulder-surfed.

MFA adds a second factor attackers can’t easily steal:

MFA Methods Ranked

Most secure → Least secure:

  1. Hardware security keys (YubiKey, Titan Key)

    • Phishing-resistant
    • No codes to intercept
    • Physical possession required

  2. Authenticator apps (Authy, Microsoft Authenticator, Google Authenticator)

    • Generate time-based codes
    • Work offline
    • Not tied to phone number

  3. Push notifications

    • Convenient
    • Risk: Users approve without checking
    • Vulnerable to push fatigue attacks

  4. SMS codes

    • Better than nothing
    • Vulnerable to SIM swapping
    • Phone number can be ported by attackers

Avoid SMS for important accounts. Attackers can convince your carrier to transfer your number to a new SIM card, intercepting all SMS codes.

I use hardware keys for critical accounts (email, password manager) and authenticator apps for everything else. SMS only when no other option exists.

Enable MFA Everywhere It’s Available

Priority order:

  1. Email (controls password resets for other accounts)
  2. Password manager (master key to everything)
  3. Financial (banks, investment accounts, PayPal)
  4. Social media (prevent account takeover)
  5. Everything else

If an account offers MFA and you’re not using it, you’re one breach away from account takeover.

Password Managers: Essential Tool

Remembering unique 20+ character passwords for every account is impossible. Password managers solve this:

What they do:

  • Generate random passwords (20-50 characters)
  • Store passwords encrypted
  • Auto-fill login forms
  • Sync across devices
  • Alert when passwords appear in breaches

Options:

  • Bitwarden (open source, free tier, $10/year premium)
  • 1Password (polished, family sharing, $3/month)
  • KeePass (offline, completely local, free)

The one password you must remember: Master password for the password manager itself.

Make it a Diceware passphrase, longer than the six words you’d use elsewhere since this is the one key that unlocks everything else:

  • gravel orbit lantern thicket canyon bridle forty: seven words, 60+ characters, north of 90 bits of entropy
  • No autobiographical trail to reconstruct
  • Typed daily during setup week, it’s memorized within days

Everything else can be randomly generated:

  • kJ8$mN2#pL9@vR5&wX3!qZ7
  • Unique per site
  • No need to remember

When I switched to a password manager, I went from reusing 5-6 passwords across 100+ accounts to having unique passwords everywhere, and cognitive load decreased along with it.

Breach Monitoring

Set up automated monitoring:

Email alerts:

  • Have I Been Pwned - Free email notifications
  • Password managers (most include breach monitoring)

Browser extensions:

  • Check if site passwords are compromised
  • Alert during sign-in if password is weak

When you get an alert:

  1. Change password immediately
  2. Check other accounts for reuse
  3. Enable MFA if not already enabled
  4. Review recent account activity

I’ve received 3 breach alerts in the past year. Each time, I changed the password within minutes. No account takeovers, no damage.

What I Actually Do

My current password security:

  • Passphrase for password manager: 7+ word Diceware passphrase, no autobiographical content
  • Unique passwords per site: Random 25-character strings generated by password manager
  • MFA everywhere: Hardware key for email/password manager, authenticator apps for everything else
  • Breach monitoring: Automated alerts from Have I Been Pwned
  • No password rotation: Change only when compromised

Results:

  • Zero account takeovers in 5+ years
  • No password reuse across any accounts
  • Every password unique and strong
  • Less mental overhead than before

Common Objections

“Password managers are a single point of failure”

True, but:

  • Encrypted with your master password (even if breached, data is encrypted)
  • Protected by MFA (can’t access without second factor)
  • Better than reusing weak passwords everywhere

Risk of password manager breach + crack encryption + bypass MFA is lower than risk of credential stuffing with reused passwords.

“I can’t remember passphrases”

Don’t build it from your own biography. Roll the words instead, then build a short, absurd mental image that chains them in order. The randomness doesn’t cost you memorability; the story you build on top of it does the remembering for you. A few days of typing it during setup and it’s muscle memory.

“This is too much work”

Setup takes one weekend:

  1. Install password manager
  2. Create strong master password
  3. Import existing passwords
  4. Replace weak passwords as you use sites
  5. Enable MFA on critical accounts

Maintenance: Zero. The password manager handles everything.

“SMS MFA is fine”

Until someone SIM swaps your number:

  • Attacker calls carrier pretending to be you
  • “I lost my phone, transfer my number to new SIM”
  • Carrier complies (happens frequently)
  • Attacker receives all your SMS codes

Happened to a colleague. Lost access to email, banking, and social media in under an hour. Used authenticator apps now.

Key Takeaways

What actually improves password security:

  • Length over complexity: 20+ characters beats uppercase+lowercase+number+symbol
  • Unique passwords everywhere: Password manager generates and remembers them
  • Breach monitoring: Know when passwords are compromised
  • No scheduled rotation: Change when there’s a reason, not on a calendar
  • MFA everywhere: Preferably hardware keys or authenticator apps, avoid SMS
  • Passphrases over passwords: Easier to remember, harder to crack

Traditional rules (8 chars, complexity, rotation) create weak passwords. Modern approaches based on how breaches actually happen work better.

The goal isn’t following rules. It’s preventing unauthorized access. Long unique passwords + breach monitoring + MFA accomplish this better than “P@ssw0rd!” rotated quarterly.