The Password Rules You Grew Up With Were Just Declared Wrong

Change your password every 90 days. Mix in a capital letter, a number, a symbol. Never write it down anywhere, ever, under any circumstances. That advice shaped decades of corporate IT policy and personal habit, and the agency responsible for originally recommending it has now formally reversed most of it. This isn’t a fringe opinion from a security blog — it’s the U.S. government’s own current standard, and the reversal happened because the old advice was measurably making account security worse, not better.

What Actually Changed, According to the Source Itself

The specifics matter here, because a lot of casual security advice still repeats the outdated version. NIST’s Digital Identity Guidelines, Special Publication 800-63B, finalized its fourth major revision in 2025, moving decisively away from composition rules and forced password rotation, instead prioritizing password length as the primary driver of real-world security, requiring a minimum of 15 characters for passwords used as a single authentication factor, explicitly prohibiting the imposition of arbitrary complexity requirements like mandatory symbols or capital letters, and recommending against scheduled password changes unless there’s actual evidence of compromise. The reasoning behind the reversal is straightforward once stated plainly: forcing frequent changes and rigid complexity rules pushes people toward predictable patterns — incrementing a number at the end, swapping a letter for a similar-looking symbol — that are easier, not harder, for automated cracking tools to guess, while a long, unique passphrase built from ordinary words is dramatically harder to brute-force despite being easier for an actual person to remember.

This matters immediately for how you should be thinking about your own accounts. A long passphrase — four or five unrelated words strung together — now genuinely outperforms the old “P@ssw0rd!23” style of password the previous guidance encouraged, and doesn’t need to be changed on any fixed schedule as long as it hasn’t shown up in a known breach.

The Single Habit That Does the Most Work

If password quality matters, a second factor matters considerably more, and the evidence here is unusually direct rather than theoretical. Microsoft’s own research team studied the effectiveness of multi-factor authentication across a large dataset of commercial accounts, including accounts with known credential leaks, and found that over 99.99% of MFA-enabled accounts in their sample remained secure during the investigation period, even accounts where the underlying password had already been compromised. That’s not a marginal improvement — it’s close to a complete defense against the most common category of automated account-takeover attempt, and it holds even when the first line of defense, the password itself, has already failed.

It’s worth being specific about which kind of MFA actually delivers this level of protection, because not all forms are equal. The same body of research and current NIST guidance both point toward app-based authenticators, hardware security keys, and passkeys as meaningfully stronger than SMS-based codes, which remain vulnerable to interception and SIM-swapping attacks that other MFA methods largely avoid. If a given account only offers SMS as its second factor, it’s still worth enabling — it’s dramatically better than no second factor at all — but where a stronger option exists, it’s worth the small extra setup effort.

Why Password Reuse Undermines Everything Else

None of the above matters much if the same password is reused across many accounts, because a single breach anywhere in that chain effectively compromises every other account using the same credential. This is where a password manager earns its place as close to a mandatory tool rather than a nice-to-have convenience — it makes generating and remembering a genuinely unique, long passphrase for every single account practically effortless, removing the actual reason most people reuse passwords in the first place, which is that remembering dozens of unique long passphrases unaided simply isn’t realistic.

This connects to a broader theme worth internalizing about digital security generally, one that applies well beyond passwords specifically: the habits that actually work over the long run tend to be the ones that remove the need for constant vigilance, rather than the ones that demand it indefinitely. A password manager and MFA both function this way — set up once, they provide ongoing protection without requiring you to remember complicated rules or stay perpetually alert. That’s a meaningfully more sustainable approach than any advice requiring continuous discipline to work.

Recovery Options Are Often the Weakest Link

A frequently overlooked piece of account security is the recovery path — the backup email, phone number, or security questions used to regain access if the primary credentials are lost. It’s easy to focus entirely on the front door of an account, the password and MFA prompt, while leaving a side door propped open by an old, forgotten fallback option nobody has looked at since the account was first created. This is worth auditing specifically, because it’s often set up hastily during account creation and rarely revisited. An outdated recovery phone number tied to a phone you no longer own, a recovery email that’s itself poorly secured, or security questions with answers that are publicly discoverable (a mother’s maiden name, a first pet’s name posted on social media years ago) can each become the actual point of failure even when the primary password and MFA setup are both strong.

This is directly relevant to the same category of risk covered in our piece on how AI is changing online scams — publicly available personal information is exactly what feeds both social engineering attempts and weak recovery question answers, so tightening one has real spillover benefit for the other.

Recognizing When Someone’s Trying to Get In

Strong credentials matter less if you don’t notice when they’re being tested. Most major platforms now offer login notification alerts, showing when and from where an account was accessed, and reviewing these periodically — rather than only after something’s already gone wrong — catches attempted breaches while there’s still time to act. This connects to the verification instincts worth building generally when something digital seems off. Our guide to recognizing AI-generated phishing covers the broader discipline of treating unexpected, urgent digital requests with independent verification rather than trusting them at face value — the same instinct applies directly to an unexpected “new login detected” alert or a password reset email you didn’t request.

Putting It All Together: A Practical Priority Order

Given limited time and attention, the order in which these changes get made matters. Enable MFA first, on every account that offers it, prioritizing app-based or hardware-key options over SMS where available — this single step delivers the largest security gain for the least effort, based directly on the research above. Second, adopt a password manager and let it generate and store long, unique passphrases for every account rather than continuing to reuse or slightly modify existing passwords. Third, audit recovery options on your most important accounts — email, banking, and anything tied to your identity — specifically checking that recovery phone numbers and email addresses are current and themselves adequately secured. Only after those three are in place is it worth spending additional time manually updating older, weaker passwords one by one, since the password manager will naturally surface and can auto-generate replacements for those as you go.

Why This Reversal Took So Long to Happen

It’s worth understanding why guidance that shaped decades of policy took this long to correct, because the answer says something useful about how to evaluate security advice generally going forward. The original complexity and rotation rules weren’t arbitrary when first introduced decades ago — they were reasonable extrapolations from theoretical cracking models at the time. What changed wasn’t the math of password strength in the abstract; it was the accumulation of real-world behavioral data showing how actual people respond to those rules in practice; predictably, not randomly. Forced rotation didn’t produce a fresh, unguessable password every 90 days. It produced “Summer2024!” becoming “Fall2024!” becoming “Winter2025!”, a pattern trivial for automated tools to anticipate once they know rotation is happening on a schedule.

This is a useful lesson beyond passwords specifically: security guidance that sounds rigorous and disciplined isn’t automatically effective, and the actual test is always how real people behave under a given rule, not how sound the rule appears in isolation. NIST’s willingness to reverse decades of its own prior guidance, once the behavioral evidence became clear, is itself a signal worth taking seriously — it’s not a body issuing casual opinions, it’s the standard the rest of the security industry largely follows, updating its position based on what the data actually showed rather than institutional inertia.

A Quick Audit of Your Own Account Security

A useful, honest exercise: pick your five most important accounts — email, banking, and whatever else would cause real damage if compromised — and check three things for each. Is MFA actually enabled, and if so, is it app-based or a hardware key rather than SMS-only? Is the password unique to that account, or a variation of one used elsewhere? And is the recovery information current and itself reasonably secure? Most people, being honest, will find at least one of their most important accounts falling short on at least one of these three, which is exactly where the highest-leverage improvement is waiting.

Frequently Asked Question