Password Hygiene and MFA: The Basics Done Right

Password advice has changed more than most people realize. Some of what was standard guidance a decade ago — force frequent changes, require a special character — is now considered outdated or even counterproductive by the organizations that actually study this, including NIST.

What actually makes a password strong

Length matters more than complexity. A long passphrase like "correct-horse-battery-staple" is dramatically harder to crack than a short, complex-looking password like "P@ss1!", because cracking difficulty scales with length far faster than with character variety. Current guidance generally favors longer minimum lengths over frequent forced rotation, which mostly just trains people to make small, predictable tweaks to the same password.

The single biggest real-world risk isn't a weak password — it's password reuse. If one of the dozens of services you use gets breached, and you reused that password anywhere else, attackers will try that same combination everywhere. This is called credential stuffing, and it's one of the most common ways accounts actually get compromised.

Password managers solve the reuse problem

A password manager generates and stores a unique, long password for every single account, so reuse simply stops being a temptation. The one password you actually need to remember is the master password protecting the vault itself — which is exactly why that one should be a genuinely strong, memorable passphrase.

MFA: not all methods are equal

Multi-factor authentication combines something you know (a password) with something you have (a device or key) or something you are (biometrics). Having some form of MFA is dramatically better than none — but the specific method matters more than most people realize.