Password Security in 2025: What Actually Matters

The old password advice — uppercase, lowercase, number, symbol, change every 90 days — was wrong. Not wrong-ish. Actually wrong. NIST revised its guidelines in 2017 and again in 2023. The security community moved on. Most IT policies haven't.

Here's what the evidence actually says.

What Makes Passwords Weak

Attackers don't try every possible combination. They use wordlists — dictionaries of known passwords (billions of them from past breaches), common patterns, and predictable substitutions. 'P@ssw0rd' is in every wordlist. 'Summer2024!' is in every wordlist. Anything that follows a recognizable human pattern will be tried first.

The other main vector: credential stuffing. 85% of people reuse passwords. When any site you've ever used gets breached, attackers take those email/password combinations and try them on every other major service. One breach becomes access to your email, bank, and everything else.

What Actually Works

• Unique passwords for every account. Non-negotiable. Every account that shares a password with another is a liability.
• Length over complexity. 20+ random characters or a passphrase of 5+ random words.
• A password manager to generate and store them. You can't remember 200 unique strong passwords; nobody can.
• Two-factor authentication on anything important. Even a compromised password isn't enough to get in with 2FA enabled.

The Password Manager Objection

The common pushback: 'But what if the password manager gets hacked?' It's a valid concern — the LastPass breach in 2022 showed real risks. But consider the comparison. Your current system is probably: variations of the same password, written in a notes app or browser's save-password feature, or memorized patterns you've used for years. How does that compare to a breach risk?

Bitwarden is open-source, end-to-end encrypted, free, and has been independently audited. If you want self-hosted, KeePass and Vaultwarden exist. The 'one point of failure' argument is real but not sufficient to justify the much larger risk of password reuse.

The Two-Factor Authentication Situation

SMS-based 2FA is better than nothing but is vulnerable to SIM-swapping. Authenticator apps (Google Authenticator, Authy, 1Password's built-in TOTP) are significantly more secure. Hardware keys (YubiKey, Titan key) are the gold standard but overkill for most personal accounts. SMS: use it if it's all that's offered. Authenticator app: use this over SMS whenever possible. Hardware key: consider for your most critical accounts (email, banking).

Your Actual Next Steps

1. 1Pick a password manager today. Set it up takes 20 minutes.
2. 2Change your email password to something generated and stored in the manager.
3. 3Enable 2FA on email. Email is the key to everything — password resets flow through it.
4. 4Over time (not all at once), change passwords for banking, social media, and other accounts as you log into them.
5. 5Sign up for HaveIBeenPwned.com alerts to get notified of future breaches.