Passwords, passphrases and password managers

You do not need to memorise forty impossible passwords. Modern advice is simpler: long, unique passwords, a manager to remember them, and one strong passphrase you actually know by heart.

Watch the 1-minute overview

Watch the full video guide for this module

Why length beats 'complexity'

• The NCSC explains that complexity rules (a capital, a number, a symbol) push people into predictable patterns, such as swapping 'o' for a zero, and attackers know these habits.
• Its example: 'Pa55word' with a symbol tacked on the end meets typical complexity rules but is still easy to guess.
• Several random words strung together are usually longer than a single word, and length makes a password harder to crack (NCSC).
• The NCSC's 'three random words' advice works because people can actually remember the result, which reduces reuse. Previous lessons (ps-08, ai-07) introduced the idea; this lesson shows how to build a whole system around it.

What the US standards body changed in 2025

• NIST, the US standards agency, published a new version of its digital identity guidelines (SP 800-63B Revision 4) in August 2025 (Enzoic summary).
• Where a password is the only way to sign in, it now requires a minimum of 15 characters, replacing the old 8-character habit. Where a password is used together with a second step, the minimum is 8 (Sakimura summary).
• It recommends allowing passwords of at least 64 characters, so long passphrases fit.
• Organisations 'shall not' impose arbitrary composition rules, and should not force regular password changes unless there is evidence of compromise.
• New passwords must be checked against a blocklist of common, expected or breached passwords. These are rules for organisations, but they tell you what experts now believe works.

Building a passphrase you can remember

• Pick three or more genuinely random words that do not form a phrase you would naturally say, for example by opening a book at random pages. Never use the NCSC's published examples.
• Make it longer for your most important accounts: four or five random words easily pass 15 characters.
• Avoid anything people can find about you: names, birthdays, teams, pets or your school (NCSC guidance covered in ai-07).
• You only need to memorise a few passphrases: your email, your phone or laptop login, and your password manager's main password. Let the manager handle the rest.

Password managers: your digital keyring

• The NCSC says a password manager 'stores passwords safely for you', can generate strong passwords, and can fill them in automatically.
• Autofill also protects you against phishing: the NCSC notes the password will only autofill on the correct website, so a fake page gets nothing.
• Some managers sync across your devices and warn you when a saved password appears in a breach (NCSC).
• There is no single best product. The NCSC says the best one is the one that meets your needs: think about which devices you use, cost, and features such as breach alerts.
• Protect the manager itself with a strong primary passphrase you remember, turn on 2-step verification for it, and set up any recovery options it offers, such as a trusted contact (NCSC).

What about saving passwords in your browser?

• The NCSC says letting your browser or device save passwords is safe on your own devices, and is the easiest option if you use the same browser everywhere.
• Never save passwords in a browser on a shared or public computer, such as a library or school PC (NCSC).
• On a shared family laptop, the NCSC advises not saving passwords if you are unsure who else can use it.
• Browser-saved passwords are only as secure as your device and account, so keep automatic updates on and lock your devices (NCSC).
• Not every expert agrees: Duke University's security office tells its users not to use browser 'remember my password' features and to use a password manager instead. Either way, a manager or browser store beats reusing one password.

A four-week upgrade plan

• Week 1: install a password manager (or switch on your device's built-in one) and protect it with a long passphrase and 2SV.
• Week 2: give your main email a new, unique passphrase. The NCSC says to change it as soon as possible if you ever reused it.
• Week 3: change passwords for banking, payment, shopping and social accounts, letting the manager generate long random ones.
• Week 4: change everything else as you log in, and delete accounts you no longer use.