A strong password remains the first barrier against unauthorised access to personal and business accounts. However, many of the rules we have learned over the years, such as swapping letters for symbols or changing your password every three months, no longer reflect current cybersecurity recommendations.
In this article, we bring together the essential rules for choosing a strong password, explain why some old practices are no longer recommended and show how companies can apply these rules on their platforms, including document management platforms.
Rule 1: Length is the most important factor
A long password is much harder to crack than a short, complex one. For this reason, current recommendations, such as those from NIST, place the greatest value on length. In practice, it is advisable to use passwords of at least 15 characters for your most important accounts.
For example, automated tools can crack an eight-character password with symbols in a short time. By contrast, a phrase of four or five words holds out for much longer and is easier to remember.
Rule 2: Prefer passphrases
A passphrase is a sequence of words with no obvious connection between them, such as “pencil-window-thunder-blue-comet”. It therefore combines length with ease of memorisation. However, the words should not form a well-known expression, such as a proverb, a quotation or a song lyric.
Rule 3: A different password for each service
Reuse is one of the biggest risks. When a service suffers a data breach, attackers try the same credentials on other sites, a technique known as credential stuffing. For this reason, each account should have its own password, especially email, business platforms and banking services.
Rule 4: Avoid personal information and predictable patterns
Family members’ names, dates of birth, football clubs or the company name are easy choices to guess. Similarly, patterns such as “Company2026!” or keyboard sequences are among the first combinations attackers try. Furthermore, replacing letters with symbols, as in “P@ssw0rd”, no longer adds real protection, because attack tools already know these substitutions.
Rule 5: Use a password manager
Nobody can memorise dozens of long, different passwords. That is why a password manager is now the most practical tool. The manager creates random passwords, stores them encrypted and fills them in automatically on the right sites. As a result, the user only needs to remember one strong passphrase to open the vault.
In addition, many managers warn you when a password appears in a known data breach or is being reused. In this way, the user knows exactly which accounts need fixing.
Rule 6: Enable multi-factor authentication
Even the best password can fall into an attacker’s hands through phishing or malware. For this reason, multi-factor authentication adds a second check, such as a code in an app or a security key. Whenever possible, choose authenticator apps or FIDO2 keys rather than SMS codes, which are more vulnerable.
What has changed in the recommendations
Experts no longer recommend some practices that used to be common. The following table summarises the main changes:
| Old practice | Current recommendation |
|---|---|
| Change the password every 60 or 90 days | Change it only when compromise is suspected |
| Strict rules on symbols and capital letters | Prioritise length and passphrases |
| Security questions | Recovery through a verified second factor |
| Short, complex passwords | Long, unique passwords stored in a manager |
As a result, the rules become simpler for users and, at the same time, more effective against today’s attacks.
Rules for companies
Organisations play a decisive role in protecting the credentials of their employees and partners. A modern password policy should therefore include:
- an appropriate minimum length, with no short maximum limits;
- checking new passwords against lists of compromised credentials;
- mandatory multi-factor authentication on critical platforms;
- an approved password manager made available to staff;
- individual accounts, with no sharing of credentials;
- temporary lockout after several failed attempts.
In addition, organisations should store passwords on their servers using dedicated hashing functions, such as Argon2id or bcrypt, and never in plain text.
Access recovery without weak points
A strong password is of little use if access recovery is easy to trick. For example, security questions such as “name of your first pet” have answers that often appear on social media. For this reason, recovery should rely on a second factor that is already registered, such as an authenticator app or a protected secondary email address. Furthermore, in companies, technical support should confirm the identity of anyone requesting an access reset before changing any credentials.
Passwords on shared devices
On sites, in warehouses or at gatehouses, several workers often use the same computer or tablet. In these cases, each person should have their own account and always log out after use. Likewise, the browsers on these devices should not save passwords. This prevents anyone from accessing someone else’s account simply by using the same device.
Passkeys: The next step
Passkeys are a modern alternative to passwords. Instead of typing a password, the user confirms the login with a fingerprint, facial recognition or the device’s own PIN. Because they only work on the legitimate site, they are resistant to phishing. Many services already support them and, gradually, they will also reach business platforms. However, good password rules will remain necessary for the next few years.
Raising user awareness
Rules only work if people understand them. Training should therefore be short, practical and focused on real examples. For example, showing how long an automated tool takes to crack a short password compared with a long passphrase is more convincing than a list of prohibitions. It is also a good idea to teach new staff how to install and use the password manager on their first day.
Similarly, users should know what to do when they suspect a password has been exposed: change it immediately, check whether they used it on other services and inform the IT team. In this way, a risky situation quickly becomes a controlled incident. Finally, regular awareness campaigns help keep the topic in mind and reinforce good habits.
Practical example: Passwords on a document management platform
Imagine a document management platform with hundreds of users from contractor companies. Many use the same password as their personal email, and some share a single account per company. So when one of these passwords appears in a data breach, the platform is exposed.
The company decides to review the rules. First, it creates individual accounts for every user. Next, it requires long passwords and checks them against lists of compromised credentials. Finally, it enables multi-factor authentication for everyone. As a result, the risk of unauthorised access falls significantly, without making contractors’ work more complicated.
Common mistakes when choosing a password
The most frequent mistake is using the same password for several services. Another is keeping passwords on paper next to the computer or in an unprotected spreadsheet. It is also common to share passwords with colleagues by email or message. Finally, many users ignore data breach warnings and keep using passwords that have already been exposed.
Quick checklist
- Is the password at least 15 characters long?
- Is it unique and not used on other services?
- Is it free of personal data and predictable patterns?
- Is it stored in a password manager?
- Does the account have multi-factor authentication enabled?
Frequently asked questions
Should I change my password periodically?
Only when there is a suspicion that it has been compromised. Frequent, mandatory changes tend to produce weaker and more predictable passwords.
Are password managers safe?
Yes, when they come from reputable providers and are protected by a strong passphrase and multi-factor authentication. The risk of reusing passwords is much greater.
How do I know if my password has been exposed?
Some services check whether an email address appears in known data breaches. In addition, many browsers and password managers carry out this check automatically.
Is a long password enough without multi-factor authentication?
No. A long password resists guessing attacks, but it does not protect against phishing or malware. For this reason, multi-factor authentication should always be enabled on important accounts.
Conclusion: A strong password that is easy to manage
A strong password is long, unique and stored in a password manager. Combined with multi-factor authentication, it offers far better protection than the old rules on complexity and periodic changes. As a result, individuals and companies can protect their accounts more effectively, including document management platforms, without making security a daily burden.
Read also: What IAM is and what it is for and Access permissions in document management platforms.
For more cybersecurity recommendations, see the Portuguese National Cybersecurity Centre (CNCS).