Almost everyone was taught the same set of password rules, and almost every one of them has since been abandoned by the people who wrote them. Change it every ninety days. Include an uppercase letter, a number, and a symbol. Never write it down. Those instructions were reasonable inferences from an incomplete picture, they were followed widely for two decades, and studying what people actually did in response to them revealed that each rule made the resulting passwords easier to break rather than harder.
Why the Old Rules Failed in Practice
Forced expiry is the clearest case. A person required to change a password every ninety days does not invent a new one four times a year; they take the existing one and increment it, so a password becomes a word followed by a season and a year, and the pattern is entirely predictable to anybody who has seen one previous version. Expiry also trains people to treat passwords as disposable, which is the opposite of the care a genuinely important password deserves.
Composition rules failed the same way. Requiring a symbol and a number produces a common word with a symbol substituted and a one at the end, which adds almost nothing to the search space because attack software has modeled those substitutions since the nineties. The prohibition on writing anything down came from an era when the threat was a colleague reading a note on a desk, rather than an attacker on another continent working from a database of several billion previously leaked credentials.
What the Current Advice Actually Says
Length beats complexity, which is why a passphrase of four or five unrelated words is both stronger and considerably easier to remember than a short string of substituted characters. Uniqueness beats everything, since the practical attack on ordinary people is not cracking a password but taking one from a breached service and trying it everywhere else. And a password should be changed when there is a reason to believe it is compromised, rather than on a calendar. Digital identity guidance published by the National Institute of Standards and Technology reversed the expiry and composition recommendations some years ago and told organizations to check new passwords against lists of known breached credentials instead. Enterprise policy has moved slowly since, which is why plenty of workplaces still enforce rules their own standards body no longer recommends, and why the advice a household receives at work is often a decade behind.
Why Email Comes Before Everything Else
If only one account gets attention, it should be the email address used to register everything else, because that mailbox is the master key. Anybody holding it can trigger a password reset on every other service, receive the reset link, and quietly delete the notification, and they can do so at leisure. It is the single point at which a small compromise becomes a total one, and it is routinely protected less carefully than a bank account. Email therefore gets a long unique password and a second factor, and the second factor should be an authenticator application or a hardware key rather than a text message where a choice exists, since a phone number can be moved to another device by somebody persuasive enough on the phone to a carrier. Recovery codes, printed and kept somewhere physical, complete the arrangement and are the part people skip.
What Actually Happens in an Ordinary Account Takeover
The realistic attack on a household bears no resemblance to the one people picture. Nobody sits guessing a password. A service somebody registered with years ago is breached, the credentials appear in a compiled list, and software tries that email address and password against several hundred other services automatically. Anywhere the pair was reused opens on the first attempt, and the first thing the intruder usually does is read the mailbox to find out where else the person banks or shops. That sequence explains why uniqueness matters more than strength and why email matters more than anything else. A long complicated password reused across four sites is far weaker in practice than four ordinary passphrases used once each, because the attack in question never had to break anything. It simply arrived holding a key somebody else had already copied, and tried it in every lock on the street.
The Password Manager, and the Objection People Raise
Unique passwords for a hundred accounts are not memorable, which means the choice is between a manager and reuse. The standard objection is that putting everything in one place creates a single point of failure, and the answer is that reuse already created one, distributed across dozens of services whose security you cannot see. A manager is a vault you control with one strong passphrase, and the alternative is a vault controlled by whichever forum you registered on in 2014.
Security questions deserve mention in the same breath, because they are passwords wearing a disguise and are frequently the weakest thing protecting an account. A mother’s maiden name and the street somebody grew up on are discoverable, and the correct response is to treat the answers as passwords and store fictional ones in the manager. An afternoon spent moving email, banking, and the three or four accounts holding a stored card into unique passwords with a second factor covers most of a household’s real exposure, and the ninety day reminder can be switched off on the way past.