Why Traditional Password Advice Has Failed
The password security guidance that security practitioners spent two decades promoting — long, complex passwords with uppercase letters, lowercase letters, numbers, and special characters, changed every 90 days — has been comprehensively discredited by the research that examined its actual effects on user behaviour. The complexity requirements that were intended to make passwords harder to guess instead produced a predictable set of patterns: users who must create complex passwords create them by appending numbers and special characters to dictionary words (Password1! satisfies most complexity requirements), by creating a single complex password and reusing it everywhere, or by writing passwords down in insecure locations. The 90-day rotation requirement produced similar predictable patterns: passwords cycled through a predictable sequence (Password1!, Password2!, Password3!), providing no actual security improvement while creating significant user friction.
The National Institute of Standards and Technology revised its password guidance (NIST SP 800-63B) in 2017 and the update represents a significant reversal of conventional password advice: length over complexity (longer passphrases are stronger than shorter complex passwords and are easier to remember), no mandatory rotation (periodic forced rotation creates the predictable cycling patterns described above and should be replaced with rotation only when compromise is suspected), and checking passwords against known breach lists (refusing to accept passwords that appear in the known compromised credential databases that attackers use for credential stuffing attacks prevents the most easily exploited passwords from being used).
How Password Attacks Work
The password attack methods that most account for unauthorised account access: credential stuffing (testing credentials from previous breaches against other services, exploiting password reuse — the most common attack method because the attacker does not need to guess or crack anything, only to test known valid credential pairs), phishing (deceiving users into entering their credentials into a fraudulent website or providing them directly through a fraudulent communication — the human exploitation attack that technical controls cannot fully address), and password spraying (attempting a small number of commonly used passwords across a large number of accounts, avoiding the account lockout threshold that protects against repeated failed attempts against a single account).
The credential stuffing scale that most conveys the magnitude of the problem: the dark web markets that sell breach data contain billions of username-password pairs from thousands of breaches, and the tools that automate testing these credentials against popular services can attempt millions of credential pairs per hour. The user who has an account on any of the major services affected by the breaches in these databases (which is virtually all internet users) and who reuses passwords has almost certainly had their credentials from at least one breach tested against other services that use the same username and password combination.
Password Managers: The Solution Most People Aren’t Using
The password management approach that most effectively addresses both the credential reuse and the complexity trade-off problems simultaneously: the password manager, which generates and stores a unique, strong random password for every account, requiring the user to remember only the master password that unlocks the password manager itself. The user whose password manager generates a 20-character random string for every account has credentials that cannot be cracked by any currently feasible attack and that are unique to each service, preventing credential stuffing attacks from succeeding even when one service’s breach exposes the credentials.
The password manager selection considerations that most affect the security and usability of the solution: the storage model (cloud-synced password managers like 1Password, Bitwarden, and Dashlane store encrypted vault copies on the manager’s servers, enabling sync across devices — the security of this model depends on the manager’s encryption implementation and the strength of the master password; local-storage managers like KeePass store the vault locally, requiring the user to manage their own sync and backup), the zero-knowledge architecture (the most secure password managers use zero-knowledge encryption, meaning that the manager’s servers store only encrypted data that only the user can decrypt with their master password — the manager company cannot access or provide vault contents even if subpoenaed), and the browser and mobile integration quality (which determines whether the manager is convenient enough to use consistently across all accounts).
Multi-Factor Authentication: The Control That Changes Everything
Multi-factor authentication (MFA) — requiring a second form of verification beyond the password before granting access — is the single security control that most dramatically reduces account compromise risk for typical user accounts. The account protected by MFA cannot be accessed by an attacker who has stolen the password through phishing, credential stuffing, or data breach, because the attacker also needs the second factor (the time-based one-time password generated by an authenticator app, the hardware security key, or the biometric verification) that only the legitimate account holder can provide.
The MFA implementation hierarchy from least to most secure: SMS-based MFA (the one-time code sent by text message — provides a meaningful improvement over password-only authentication but is vulnerable to SIM swapping attacks and to real-time phishing relay attacks), app-based TOTP (the time-based one-time password generated by an authenticator application like Google Authenticator or Authy — more secure than SMS, not vulnerable to SIM swapping, but still vulnerable to phishing relay attacks that prompt the user to enter the code on the phishing site in real time), and hardware security keys using the FIDO2/WebAuthn standard (the most phishing-resistant MFA available — the key authenticates the website’s cryptographic identity before signing the authentication request, refusing to authenticate to phishing sites even if the user does not recognise that the site is fraudulent).
Passkeys: The Passwordless Future
Passkeys — the FIDO2/WebAuthn-based authentication standard adopted by Apple, Google, and Microsoft and supported across major browsers and platforms — represent the most significant shift in authentication since passwords were established as the primary mechanism for account security. A passkey is a cryptographic key pair in which the private key is stored securely on the user’s device (in the Secure Enclave on Apple devices, the Android Keystore on Android, or the Windows Hello credential store) and the public key is registered with the service. Authentication uses the device’s biometric (Face ID, fingerprint) to authorise the use of the private key to sign a challenge from the service — no password is transmitted, no secret is stored on the service’s server, and the authentication is inherently phishing-resistant because the private key will only sign challenges from the registered domain.
The passkey adoption trajectory that will most determine how quickly the standard replaces passwords for mainstream users: the experience of passkeys on major consumer services (Google, Apple ID, GitHub, Microsoft, PayPal, and many others now support passkeys) is establishing the user experience that will build the familiarity and trust required for broader adoption. The passkey experience for the user — scan your face to log in, no password required — is simpler than any alternative authentication experience and more secure than any password-based approach. The transition from password-based to passkey-based authentication is expected to accelerate significantly over the next five years as platform support matures and as users experience the simplicity and security improvement firsthand.