Most advice about passwords is either frightening or useless. This is the short version of what actually matters, and what you can safely stop worrying about.
Length beats complexity
The rule everyone learned was a capital letter, a number and a symbol. That rule produced Password1!, which a cracking tool guesses almost instantly, because attackers know the rule too.
What actually makes a password hard to break is length. Three or four unrelated words is stronger than eight characters of punctuation soup, and you can remember it. Aim for at least twelve characters, and more where it matters.
Reuse is the real problem
A long, strong password used on fifteen sites is a weak password, because you only control one of those sites.
When any one of them is breached, the email address and password end up in a list, and attackers try that combination everywhere else. This is called credential stuffing and it is automated, cheap, and the single most common way small businesses lose an account. The password was never guessed. It was simply reused.
The fix is a password manager. It generates a different password for every site, remembers them, and fills them in. You learn one password and it looks after the rest.
Multi-factor is the one that stops attacks
If you do one thing from this article, do this one.
Multi-factor authentication means a password is not enough on its own. Someone who steals your password still cannot get in, because they do not have your phone. It is the difference between a stolen password being an inconvenience and a stolen password being a very bad week.
Not all methods are equal:
- Text message codes are better than nothing, but a determined attacker can persuade a mobile network to move your number to their SIM
- Authenticator apps generate a code on your device, with nothing sent over the network to intercept
- Hardware keys such as a YubiKey are the strongest option, because the key will not authenticate to a fake sign-in page even if you are completely fooled by it
For most businesses an authenticator app on every account is the right balance. Hardware keys are worth it for administrators and anyone handling payments.
Where this is heading
Passwords are slowly being replaced. Passkeys, built on the FIDO standards, let you sign in with your fingerprint, face or device PIN, with nothing to type and nothing to steal. Apple, Google and Microsoft all support them.
They are not everywhere yet, so you will be managing passwords for a while. But when a service you use offers a passkey, take it.
What to stop doing
- Forcing a password change every ninety days. It makes people pick worse passwords and write them down. Change a password when there is a reason to.
- Sticky notes and spreadsheets. A spreadsheet called passwords, even on a locked computer, is one lost laptop away from being somebody else’s.
- Security questions with honest answers. Your mother’s maiden name and your first school are on the internet. Treat the answers as extra passwords and store them in the manager.
- Sharing one login between several people. When somebody leaves, you have no idea what they still have access to.
Worth doing
Check whether your email address has appeared in a known breach at haveibeenpwned.com. It is free, it is run by a respected security researcher, and it tells you which of your accounts need attention first.
Then turn on multi-factor for your email before anything else. Email is the account that can reset all the others.
Rolling multi-factor out across a team, without a week of people locked out of things, is something we do regularly. Have a word with us if you would rather not do it yourself, or read how we handle Microsoft 365 security.
