Password Security in 2025: What Actually Protects Your Accounts

The Old Advice That No Longer Holds Up

For years, the standard advice was: use 8 characters, include a mix of uppercase, lowercase, numbers and symbols, and change your password every 90 days. This advice was based on assumptions about how passwords were attacked in the early 2000s — assumptions that no longer match how modern attacks work.

Why Forced Password Changes Backfire

When people are forced to change passwords frequently, they tend to make small, predictable modifications to existing passwords — "Password1" becomes "Password2", then "Password3". Attackers who know a previous password can often guess the pattern. Frequent forced changes also push people toward writing passwords down or reusing them elsewhere, both of which reduce overall security.

Why Complexity Requirements Often Fail

Requiring a mix of character types doesn't necessarily increase the search space attackers need to cover as much as you'd think, because people respond to complexity requirements in predictable ways — capitalising the first letter, adding "!" or "1" at the end. Attackers know these patterns and account for them.

What Actually Matters: Length and Uniqueness

Length Beats Complexity

A 16-character password using only lowercase letters is harder to crack through brute force than an 8-character password with numbers, symbols, and mixed case. Every additional character multiplies the number of possible combinations exponentially, while adding character types only multiplies it linearly. This is why modern security guidance from organisations like NIST (the US National Institute of Standards and Technology) emphasizes length over complexity.

Uniqueness Is Non-Negotiable

The single most damaging password habit is reusing the same password across multiple accounts. Here's why: when any one website you use gets breached (and breaches happen constantly, even to major companies), attackers obtain lists of email/password combinations and automatically try them on other popular websites — a technique called "credential stuffing". If you reused that password, your other accounts are compromised even though they were never directly breached.

The Password Manager Question

The practical solution to "use long, unique passwords for every account" is a password manager — software that generates and stores unique passwords for each site, so you only need to remember one master password.

How Password Managers Work

You create one strong master password. The password manager generates random, long, unique passwords for every other account and stores them in an encrypted database. When you visit a website, the manager fills in the correct password automatically. You never need to remember or type most of your passwords.

Common Objections, Addressed

"What if the password manager itself gets hacked?" — Reputable password managers use end-to-end encryption, meaning your data is encrypted before it leaves your device, using a key derived from your master password. Even if the company's servers are breached, attackers get encrypted data they can't read without your master password, which the company itself doesn't have.

"What if I forget my master password?" — This is a real risk and the tradeoff of this approach. Most managers offer recovery mechanisms (recovery keys, biometric backup), but ultimately your master password needs to be something you can reliably remember — which is why it should be a memorable passphrase rather than a random string.

How to Create a Strong Master Password

For the one password you do need to remember, the most effective approach is a passphrase — a sequence of random, unrelated words. "correct-horse-battery-staple" style passphrases are long (which matters most for security) while remaining memorable for humans, unlike random character strings.

To make a passphrase even stronger: choose 4-5 truly random words (not a common phrase or song lyric), add a number or symbol somewhere unpredictable, and consider misspelling one word slightly in a way only you would think of.

Two-Factor Authentication: The Second Layer

Even a perfect password can be compromised through phishing, malware, or a breach you have no control over. Two-factor authentication (2FA) adds a second verification step — typically a code from an app on your phone — meaning a stolen password alone isn't enough to access your account.

Enable 2FA on at least these accounts, in priority order: your primary email (since it's used to reset other passwords), your password manager itself, banking and financial accounts, and any account linked to payment methods.

App-Based 2FA vs SMS 2FA

SMS-based 2FA (codes sent via text message) is better than no 2FA, but it has a known weakness: SIM-swapping attacks, where an attacker convinces your mobile carrier to transfer your number to their device. Authenticator apps (which generate codes locally on your device without needing a network connection) avoid this specific risk and are generally recommended where available.

Generate Strong Passwords Free

Whether you're setting up a password manager or just need a strong password right now for a new account, use the free Toolivy Password Generator — it creates long, random passwords with customisable character sets and shows you a strength indicator.

A Realistic Starting Plan

Security improvements don't need to happen all at once. A realistic, sustainable approach:

1. Week 1 — Set up a password manager and create a strong master passphrase
2. Week 2 — Change your email password to a long, unique, generated password and enable 2FA on email
3. Week 3 — Update passwords for banking and financial accounts, enable 2FA where available
4. Ongoing — Whenever you log into any other account, take the moment to update its password to a generated one and save it in your manager

Within a few months of this gradual approach, the majority of your important accounts will have strong, unique passwords — without the overwhelm of trying to fix everything at once.

Frequently Asked Questions