How to Create a Secure Password, and How to Stop Managing Them by Hand
Most password advice still in circulation is ten years out of date. The rules were rewritten by the US National Institute of Standards and Technology, whose guidance most standards, auditors and cyber insurers now follow, and they are simpler than the old ones: make passwords long, make each one unique, stop changing them on a schedule, check them against known leaks, and put multi-factor authentication or a passkey in front of anything important. We have folded four older articles into this one, on password tips, browser-saved passwords, password recovery and protection. It covers how to create a password that is actually strong, why a password manager is the real answer, what to do about the passwords in your browser, and what to do when one leaks.
The current rules, in one table
| Old advice | Current guidance | Why it changed |
|---|---|---|
| 8 characters with a capital, a number and a symbol | 15 characters or more; length matters, composition rules do not | P@ssw0rd1 is guessed in seconds; a long passphrase is not |
| Change every 90 days | Change only when compromised | Rotation produces predictable passwords and does not stop same-day use of a stolen one |
| Security questions for recovery | Recovery through a second factor or an administrator | Mother’s maiden name is public information |
| Do not write passwords down | Use a password manager; a sealed note in a safe is fine for the master password | The alternative was reuse, which is far worse |
| Passwords are the security | Passwords plus MFA, or passkeys instead of passwords | Most account takeovers now use a stolen password, not a guessed one |
How to create a strong password
Use a passphrase: three to five words chosen at random, joined with a separator, such as copper-violin-harbor-tuesday. It is long enough to resist any guessing attack, easy to type and possible to remember. Avoid quotations, song lyrics, your dog’s name and anything that appears about you online, because attackers feed all of that into their guessing lists. Do not use the same passphrase, or a variation of it, for two accounts; when one site leaks, the criminals try that password everywhere else within hours. That last rule is the one nobody can follow by memory, which is why the next section exists.
Use a password manager for everything else
A password manager generates a different random password for every account, stores them in an encrypted vault, and fills them in. You remember one master passphrase and the manager remembers the rest. It also spots reused passwords, checks for known leaks, and stores the recovery codes for your MFA. Bitwarden, 1Password and Keeper are the ones we deploy; business editions add shared vaults for team accounts, single sign-on and an administrator who can recover access when someone leaves. Choose a long master passphrase, turn on MFA for the manager itself, store the recovery code somewhere physical, and set up emergency access for a trusted person.
What about passwords saved in the browser?
Chrome, Edge and Safari offer to save every password, and most people accept. It is better than reusing one password, and the browsers encrypt the store. Two weaknesses matter for a business. Infostealer malware, the kind that arrives through a fake software download or a cracked application, is written specifically to harvest browser password vaults and session cookies, and it does so in seconds. And a browser signed into a personal Google or Microsoft account syncs company passwords to every device that person owns, including the family laptop. For work accounts, use a password manager and turn off the browser’s own saving through device management; under a managed IT plan that is a policy, not a request.
Put something in front of the password
A stolen password is now the most common way into a business, and no amount of password strength stops a criminal who already has it. Multi-factor authentication on every account is the control that does; our MFA setup guide covers Microsoft 365, and what MFA is and which type to use explains the options. Better still are passkeys, which replace the password with a cryptographic key on your device unlocked by your fingerprint, face or PIN; nothing is typed, so nothing can be phished. Microsoft, Google and Apple accounts support them, and Microsoft Entra ID supports them for business sign-in, which is where we are moving clients.
When a password leaks
Passwords leak from other people’s breaches, not usually from yours. The free Have I Been Pwned service shows which breaches included an address; Microsoft 365 and Google flag sign-ins with leaked credentials; password managers check vaults against known lists. When one leaks: change it on that account and anywhere it was reused, sign out of all sessions, check for forwarding rules or recovery-address changes the attacker may have added, and turn on MFA if it was off. If the leaked password was for email, read what to do if your email has been hacked; if you are seeing MFA prompts you did not request, this explains why.
Recovering a lost password, without weakening everything
For a Microsoft 365 or Google account, self-service reset with a verified phone or authenticator, or an administrator, is the recovery path; under a managed plan the help desk verifies identity and resets it in minutes. For a Windows computer joined to the company, the administrator resets it and BitLocker’s escrowed recovery key handles the encrypted disk. Local accounts, network equipment and old servers are the awkward ones: recovery there is usually a reset that requires physical access, which is why every business should keep a sealed record of break-glass administrator credentials and recovery keys, kept current, somewhere two people can reach. Our offboarding checklist covers the passwords that have to change when someone leaves.
A password policy for a small business
- Minimum 15 characters, no composition rules, no scheduled rotation; enforce through Microsoft Entra ID or Google.
- Banned-password lists on, so nobody can use the company name, the season or anything already leaked.
- MFA required on every account, phishing-resistant for administrators; passkeys where supported.
- A business password manager for every employee, with shared vaults for team accounts and browser saving turned off for work.
- Separate administrator accounts that nobody uses for email.
- Self-service reset set up in advance, and break-glass credentials sealed and current.
- Short, regular security awareness training, because the attack that gets a password is a phishing email; the phishing quiz shows what those look like now.
Cyber-insurance applications now ask about most of this list by name; the cyber insurance readiness check shows the questions.
Free tools from OAC Technology
- Phishing quiz: ten realistic emails, one at a time, with the tells explained
- Cyber insurance readiness check: fourteen questions insurers ask, scored in a minute
- IT glossary: the terms in this article, explained plainly
Common questions
How long should a password be?
At least 15 characters for anything that matters, and longer is better. Length is what defeats guessing; a four-word passphrase such as “copper-violin-harbor-tuesday” is both stronger and easier to remember than eight characters of symbols. Current federal guidance sets 15 as the minimum where a password is the only factor.
Should we still change passwords every 90 days?
No. The current NIST guidance, which most standards and insurers now follow, says to change a password when there is reason to think it was compromised, not on a schedule. Forced rotation produces predictable passwords like Spring2026! and does nothing against a criminal who uses a stolen password the same day.
Is it safe to save passwords in the browser?
Safer than reusing one password everywhere, and weaker than a password manager. Chrome and Edge encrypt saved passwords, but infostealer malware is written specifically to harvest browser vaults, and a shared or unlocked computer exposes them. For business accounts, use a password manager with its own master password and MFA.
Is a password manager safe?
Yes, and it is the single most effective change most people can make. The vault is encrypted with a master password the vendor never sees, so even a breach at the vendor yields nothing usable. Choose a reputable product, use a long master passphrase, turn on MFA for the manager itself, and never lose the recovery code.
What is a passkey?
A sign-in method that replaces the password with a cryptographic key stored on your phone or computer and unlocked with your fingerprint, face or PIN. Nothing is typed, so nothing can be phished or reused. Microsoft, Google and Apple accounts support passkeys now, and Microsoft Entra ID supports them for business accounts.
What if I forget the master password?
Use the recovery code or emergency access you set up when you created the vault. If you did not, the vault is gone; that is the design. For business accounts an administrator can reset your Microsoft 365 password, and under a managed plan the help desk verifies identity and resets it within minutes.
Talk to us
If your business is still living on shared spreadsheets of passwords and 90-day resets, we will set up a password manager, MFA and a sensible policy, usually within a week. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
