2.1 Passwords done properly

Escaping complexity theatre

Passwords are still how most of us sign in. They are also wildly misunderstood.

Lots of organisations still force rules that look tough and do very little. Call it "complexity theatre": security that feels strict, makes daily life worse and is often easier to break.

Knowing what actually makes a password strong beats memorising arbitrary rules. It also lets you pick habits that fit real life: a family laptop, a work machine on the train, a pile of accounts for the bank, the council and the energy supplier.

Why traditional complexity rules failed

The classic rules: upper and lower case, a number, a symbol, change it every 90 days. Sounds hard to guess. In practice, everyone does the same thing:

• capital letter at the start;
• number at the end;
• a symbol swapped in for a letter.

Attackers know this. Their "password spraying" and guessing lists are full of p@ssw0rd! and Summer2025. The rules never made passwords unpredictable. They just made them harder to remember.

The deeper mistake is judging how a password looks rather than how it holds up under attack. Most accounts are not cracked by someone patiently guessing. They fall to automated tools running through likely passwords, or to leaked password databases.

• If the service limits guessing, extra symbols barely matter.
• If it does not, complexity will not save you anyway.

Good rules match the real threat, not an imagined one.

Length vs randomness

Length usually matters more than complexity. More characters means more possibilities to brute-force, even with letters only. Randomness matters because it removes the patterns attackers exploit. Best of all: long and random.

Quick comparison:

• Blue7$ looks complex. It is short and guessable.
• harbour-lantern-marmalade is ordinary words, but long. Pick the words at random from a big list and it becomes extremely hard to guess.

That is why modern policies push length (often a minimum of 12 or 14 characters) and allow spaces.

One catch: random does not mean "looks random to a human". It means no pattern that shrinks the search. Words that remind you of a holiday or your cat are not random. That phrase may still survive broad attacks, but it is weaker against someone who knows you.

Passphrases and memorability

Passphrases work because they are long and memorable. A good one is several words chosen at random, not a line from your favourite book. Most people can hold four or five unrelated words in their head far more easily than a string of symbols, which means fewer sticky notes and less reuse.

What this looks like day to day:

• New email account: generate a passphrase from a random word list, then save it in your password manager. You will remember it from typing it; if you forget, the manager has it.
• Shared household account (say, a streaming service): a long, easy-to-say passphrase in the family manager, or written down somewhere secure like a locked drawer. That trade-off fits how people actually live.

Myth to drop: a passphrase does not need to be nonsense or full of obscure words. It just needs to be random and long. Four words picked at random from a list of a few thousand gives a vast number of combinations, plenty to resist large-scale guessing.

Why humans reuse passwords

People reuse passwords because the alternative feels impossible. Banking, council tax, the GP, shopping, work tools, that one-off account for a train ticket... dozens of them. Remembering a unique, strong password for each is not realistic without help. Reuse is a rational response to a system that dumps the whole burden on you.

The problem: reuse turns one breach into many. A shop's database leaks, attackers try the same password on your email, and your email is the key that resets everything else. This is not an edge case. It is one of the most common ways accounts get taken over.

The fix is not a better memory. It is a different method:

• Use a password manager (built into your browser or a dedicated app) so every password can be unique without you remembering any of them.
• No manager yet? Make sure your email and anything that can reset other accounts has its own password.

A reused forum password getting leaked is annoying. A reused email password getting leaked is a chain reaction.

The handful you must actually memorise

Once a manager holds the long, unique passwords for your everyday accounts, something useful happens: you stop needing to memorise most of them. You still need a small, critical handful. For almost everyone it is three:

• Your main device unlock (password or PIN). It guards the full-disk encryption in 3.2, so a weak one quietly undoes the best protection your phone or laptop has.
• Your password manager's master password. As 2.2 explains, it guards every other credential you own. Long, and never reused.
• Your primary email password. Most services reset through email, which makes it the master key to your digital life whether you think of it that way or not.

These are the keys that protect all the other keys. Each deserves a strong, unique passphrase of several random words, generated rather than picked for meaning, and used nowhere else.

This makes the whole thing manageable. Nobody can memorise thirty strong passwords. You can memorise three.

How to make them: use a random word-list method (often called "diceware"), where the words are picked genuinely at random rather than by you. A phrase chosen for how it sounds is far weaker than one chosen by chance, for the reasons under length and randomness above.

Get those three right, protect them with the multi-factor methods in 2.3, and the rest of your password hygiene largely looks after itself.

Avoiding personal references

Children's names, birthdays, football teams, street names: easy to remember, easy to guess. In the UK these details can be pieced together from social media, company websites and public records. Even with private profiles, friends and relatives post photos and mentions that leak clues.

Targeted attackers use this for "knowledge-based" guessing. No Hollywood hacking, just a short list of likely options tried one by one. A random passphrase with nothing to do with you shuts that route down, and beats clever wordplay about your life.

Myth: attackers go for the most obscure detail. Reality: they start with the obvious, because it works often enough. Your dog's name with a "!" on the end, or your postcode plus a year, is risky even if it feels unique.

When rotation helps and when it harms

Regular password changes used to be standard advice. They still help in specific cases:

• a password might have been exposed;
• several people share an account over time, such as a small charity changing its social media password when a volunteer leaves.

For your own accounts, forced rotation often makes things worse. People add a number or change the month, which attackers predict. It also pushes people towards writing passwords down or recycling old ones. With proper rate limits, modern password storage and multi-factor authentication, routine changes add very little.

Better: change passwords when there is a reason. For example:

• a data breach notification;
• a lost or stolen device;
• a feeling that someone else has access.

Otherwise, put your energy into strong, unique passwords and recovery methods you control.

At work there is a cost too. In UK organisations, frequent forced changes mean more helpdesk calls and risky workarounds. That is a real cost, not just grumbling. Security people bypass is not security. A sensible policy fits how people work, not how a checklist reads.