Passwords in 2026: what actually keeps your accounts safe

When a hacker broke into Romania's national land registry this month, they left a line that is the whole password problem in one sentence: "the hope was that one of the cracked passwords would work." It did. I wrote up what actually failed at ANCPI separately, but the uncomfortable part is that the fix starts with the most basic thing almost everyone gets wrong: passwords.

Here is the good news: the rules got simpler in 2025, and a lot of the advice you were taught is now officially wrong.

Length beats complexity, and the rules actually changed

In July 2025, NIST, the US body whose guidance the whole industry follows, finalized SP 800-63B-4, replacing the 2020 edition. It inverts decades of password theatre:

• Length is the thing. A password used on its own must be at least 15 characters; 8 is only allowed when it sits behind MFA. Systems must accept at least 64 characters, so long passphrases are welcome.
• No more forced symbols. Verifiers "SHALL NOT impose other composition rules" - no mandatory uppercase-lowercase-number-symbol. The "must contain a special character" ritual is gone.
• No more forced 90-day changes. You may no longer be made to rotate passwords on a schedule - only when there is actual evidence one was compromised.
• Your password gets checked against breach lists. New passwords are screened against known-compromised and common-word blocklists, and rejected if they match.

The man who wrote the original 2003 "use symbols and change often" rules, Bill Burr, said the quiet part out loud back in 2017: "Much of what I did I now regret." 2025 made the regret official.

Use a passphrase, not a password

If length wins, the easiest strong secret is a passphrase - a few genuinely random words. Not a sentence you made up (predictable), but words picked at random.

The math is on your side. Using the EFF/Diceware list of 7,776 words, each random word adds about 12.9 bits of entropy. A six-word passphrase carries roughly 77.5 bits which, per Diceware's own creator, is breakable only by "an organization with a very large budget, such as a large country's security agency." Four or five random words is plenty for everyday accounts.

otter cargo velvet echo brisk beats P@ssw0rd! on every axis: it is longer, genuinely random, and you can actually remember it. (The famous "correct horse battery staple" was making exactly this point.)

The one habit that matters most: never reuse

Here is what no clever passphrase fixes: using the same password in two places. That is exactly what the ANCPI attacker was counting on. One site gets breached, your email and password land in a "combo list," and attackers replay that pair against your bank, your inbox, your Microsoft 365 - automatically, millions of times a day. It is called credential stuffing, and it works because reuse is everywhere.

So the highest-impact habit is not a stronger password. It is a unique one per site - impossible to do from memory, and trivial with a password manager. It generates a long random password for every account and remembers them all; you only remember one strong passphrase.

Be honest about the trade-off: a manager is a single juicy target, and yes, LastPass had a serious breach in 2022 in which encrypted vaults were stolen. But the answer is not "go back to reusing passwords" - it is a strong master passphrase you use nowhere else, MFA on the vault, and a reputable manager. Unique-everywhere still wins by a mile.

Turn on MFA, and know that not all MFA is equal

A second factor means a stolen password is not enough on its own. Microsoft's own research puts it at roughly 99.2% of account-compromise attacks blocked by MFA (they used to say 99.9%; treat vendor numbers with a pinch of salt, but the direction is not in doubt).

Not every second factor is equally good. CISA ranks them:

• Best, phishing-resistant: passkeys and security keys (FIDO). The "gold standard."
• Good enough for now: an authenticator app (the six-digit codes or number-matching prompts). Still phishable through fake login pages, but far better than nothing.
• Last resort: SMS text codes. Vulnerable to SIM-swap and interception. Use only when it is the only option.

Passkeys: the actual future, and it is already here

The endgame is no password at all. A passkey is a cryptographic key stored on your device - your phone, laptop, or a security key. When you sign in, the device proves who you are with your face or fingerprint; the secret never leaves the device and is never typed, so there is nothing to phish, leak, or reuse. It is built on FIDO2/WebAuthn, the same public-key cryptography that secures the web.

This is not a lab experiment. The FIDO Alliance reports about 5 billion passkeys in use as of May 2026, with 75% of surveyed people having enabled at least one. Google, Microsoft, Apple, and most large services support them now. When a site offers "sign in with a passkey," take it.

The checklist

If you are a person:

1. Get a password manager. This one habit fixes the most.
2. Make every password unique and long - let the manager generate them.
3. Use a passphrase (five or six random words) for the few you actually type, starting with your email and your manager's master password.
4. Turn on MFA everywhere - an authenticator app over SMS.
5. Switch to passkeys wherever they are offered.

If you run a small team:

1. Roll out a team password manager and kill the shared logins living in spreadsheets.
2. Require MFA on everything, especially email and Microsoft 365 or Google Workspace.
3. Move admins to phishing-resistant MFA (passkeys or security keys) first.
4. Stop forcing 90-day changes; screen new passwords against breach lists instead.
5. Check your domains and staff emails against breach data (Have I Been Pwned).

None of this is expensive or clever. That is the point - and it is exactly why breaches like ANCPI are so frustrating. The tools that stop the boring 80% of account takeovers are free, well-documented, and mostly one settings toggle away. If you would rather have someone set it up properly across identity, MFA and passkeys, that is Microsoft 365 and Azure consulting territory - or a quick security and automation audit to find the gaps. Either way: turn these on before the headline, not after.