The State of Password Security

Passwords remain the primary authentication method for most online services. Despite predictions of their demise, passwords persist because they are simple, universal, and require no special hardware.

However, the threat landscape has evolved dramatically. Credential stuffing attacks (using leaked passwords from one breach to access other services) account for the majority of account compromises. Password spraying (trying common passwords against many accounts) and phishing continue to be effective attack vectors.

The fundamentals of password security haven't changed, but the stakes have risen. A compromised password can now lead to identity theft, financial loss, ransomware infection, and reputational damage.

Creating Strong Passwords

Length over complexity: A 20-character lowercase passphrase is stronger than an 8-character complex password. "correct-horse-battery-staple" is both more secure and more memorable than "P@s5w0rd!".

Passphrases: String together 4-6 random words to create a passphrase. Use a random word generator rather than choosing words yourself (humans are terrible at randomness).

Uniqueness is paramount: Every account should have a unique password. This is the single most important password security practice. If you do nothing else, stop reusing passwords.

Avoid predictable patterns: Names, dates, dictionary words, keyboard patterns (qwerty), and sports teams are all in attacker dictionaries. Avoid them.

Password Managers

A password manager is the most important security tool most people aren't using. It generates, stores, and auto-fills unique, strong passwords for every account.

Top options in 2026: • 1Password — Excellent UI, family sharing, travel mode • Bitwarden — Open source, affordable, self-hosting option • Dashlane — Strong security features, dark web monitoring • KeePass — Fully offline, open source, maximum control

The master password: Your password manager is only as secure as its master password. Make this your strongest credential — a long passphrase that you memorize and never write down digitally.

Emergency access: Most password managers support emergency access features. Designate a trusted person who can request access after a waiting period. For more robust emergency access, combine your password manager with a ZeroLatch dead man's switch that releases your master password to your designee.

Beyond Passwords: MFA and Passkeys

Enable supported multi-factor authentication and preserve the provider's recovery procedure. Security keys, authenticator apps and SMS have different properties; review the options for your actual account rather than assuming one method fits every situation.

Passkeys use public-key cryptography. As the FIDO Alliance explains, passkeys may be synced through a provider or bound to a particular device. They are designed to resist phishing, but that does not remove risks from account recovery, compromised devices or misleading authorisation requests.

Record which provider or device holds each important passkey and what an authorised person should do if it is unavailable. A list of account names and official recovery routes is more useful than claiming a passkey can simply be inherited. Keep passwords and recovery factors out of a general family note.