A strong password isn't about being clever — it's about being long and impossible to guess. A weird sentence beats a fancy short word every time.
"correct-horse-battery-staple" is actually stronger than "P@ssw0rd!" — length matters more than symbols. Aim for at least 12–16 characters. This isn't just conventional wisdom anymore; it's the actual official guidance. NIST — the US government's National Institute of Standards and Technology, whose password recommendations influence security standards worldwide — released the final version of its updated digital identity guidelines (SP 800-63-4) in mid-2025, and the changes were significant. Composition rules like "must contain a symbol, a number, and a capital letter" are no longer recommended at all; the emphasis is entirely on length. Perhaps more surprisingly, forced periodic password changes — the old "change your password every 90 days" policy most workplaces have run for decades — are now explicitly discouraged, hardened in the new guidelines from "should not" to "shall not," unless there's actual evidence a specific password has been compromised.1
In practice, the strongest easy-to-remember approach is stringing together several unrelated words — four or five, not two — into something that reads almost like a strange sentence rather than a normal password. "correct horse battery staple" is a classic example precisely because the words have nothing to do with each other; that lack of connection is what makes it hard to guess, even though each individual word is common. A password like "Fluffy2024!" feels secure because it has a capital letter, a number, and a symbol, but it's actually easy to guess — attackers already assume people do exactly this, and their guessing tools account for it directly.
If one site leaks your password and you use it everywhere, a hacker now has the key to everything, not just the one account that was actually breached. Every important account deserves its own unique password — and given how many accounts most people actually have, doing this from memory alone simply isn't realistic for anyone.
Nobody can remember 50 different strong passwords, and nobody should have to. A password manager creates and remembers them for you, so you only need to remember one master password. Here's the honestly frustrating part: adoption remains surprisingly low given how effective and low-cost the solution is. Security.org's fourth annual password manager study found only 36% of US adults currently use one — an increase of just two percentage points over the year before, essentially flat.2 But the more telling number is what non-users say: 75% of people who don't currently use a password manager say they would adopt one, if the balance of usability, security, and price felt right. The problem isn't that people don't see the value — it's friction getting in the way of a decision most people already agree with.
Two-factor authentication means even if someone steals your password, they still need a second thing — like a code sent to your phone, or a tap on an app — to actually get in. It's one of the single best protections that exists, and it's increasingly being paired with, or replaced by, something even stronger: passkeys, which don't rely on a typed secret at all.
Passkey adoption has genuinely taken off — recent estimates put the share of users with at least one passkey set up at around 69%.3 But there's a real gap on the other side of that equation: only about 48% of the internet's top 100 websites actually support passkey login yet.4 The demand and the willingness are there; the infrastructure to actually use it everywhere still isn't. In the meantime, that makes traditional strong passwords, paired with a password manager and MFA, still the practical baseline for most of what anyone logs into day to day.
The advice hasn't fundamentally changed, but the official guidance behind it has gotten simpler and more evidence-based. A few practical takeaways: