Password Myths Busted

Much of the password advice in circulation today was written in the early 2000s, when the main threat was brute force and the main constraint was typed-from-memory credentials. Both of those things have changed significantly. The bodies that created the original guidance — notably NIST in the US and the NCSC in the UK — have since revised or withdrawn most of it. Here is what the evidence actually says.

Myth 1: You should change your password every 90 days

Mandatory periodic rotation was introduced on the assumption that regular changes would limit exposure if a credential was stolen. In theory, rotating every 90 days means a stolen password expires in at most 90 days.

In practice, users respond to forced rotation by making small, predictable changes: Password1 becomes Password2, then Password3. Attackers know this. Password-cracking rulesets include increment patterns specifically because they are so common. The rotated password is often weaker than the original.

NIST formally revised their guidance in SP 800-63B (2017), explicitly stating that verifiers should not require periodic password changes without evidence of compromise. The NCSC followed with similar guidance. The correct trigger for a password change is evidence of compromise — a breach notification, suspicious login activity — not the passage of time.

Myth 2: Complex beats long

Complexity rules — at least one uppercase, one digit, one symbol — became standard largely because they made passwords harder to brute-force in the context of short, typed passwords. The assumption was that users would create 8-character passwords, and complexity was needed to expand the effective character set.

The problem is that complexity requirements push users toward predictable patterns. A capital at the start, numbers at the end, and a symbol somewhere — this structure is one of the first things dictionary rules apply. The "complex" password Summer2024! is trivially cracked by a ruleset because it follows the exact pattern the ruleset is designed to exploit.

Length is the more effective lever. A 20-character lowercase passphrase has more entropy than a 10-character mixed-character string following a predictable structure. NIST's revised guidelines explicitly de-emphasise complexity requirements in favour of length and uniqueness.

Myth 3: A symbol makes any password secure

Adding !, @, or # to a password does marginally increase its character set, but the security benefit is almost entirely negated if the addition is patterned. The most common symbol positions in human-created passwords are the end and, to a lesser extent, the beginning. Inserting symbols mid-word in place of predictable letter substitutions (the "leet speak" pattern) is equally well-known to attackers.

Symbols add real security when they are placed randomly throughout a randomly generated password. In that context, they expand the character set and increase entropy per character. In the context of a dictionary word with a symbol appended, they add almost nothing.

Myth 4: Writing a password down is always dangerous

This myth originated in the era of shared terminals and office environments where a written password was a physical security risk. It remains true in those contexts. But the security calculus has changed for most people.

For most individuals, the realistic threat is a remote attacker, not a physical intruder with access to your home or private office. A password written on paper and stored in a locked safe or secure drawer is more secure against remote attackers than any password kept only in memory — because humans use memorable passwords, and memorable passwords are weak.

The NCSC's current guidance acknowledges that writing down passwords in a secure physical location is a reasonable approach, particularly for infrequently used credentials. The important constraint is the location: not on a monitor, not in a wallet, not in an email draft. In a locked container, away from the device it protects.

Myth 5: Security questions add meaningful protection

Security questions were introduced as a lower-security alternative to 2FA — a fallback for account recovery. The design is flawed from the start: the answers are supposed to be memorable but not guessable. For most people, they are both.

The answers to common security questions — mother's maiden name, childhood pet, home town, first school — are available from social media, public records, or casual conversation. High-profile account compromises have repeatedly exploited this. The "verification" provides a path into an account that is easier to exploit than the password itself.

The correct approach is to treat security question answers as passwords: generate random strings and store them in your manager. This renders the questions meaningless as a social-engineering vector, which is precisely the goal.

Myth 6: A longer password is always better, without limit

This one is directionally correct — longer is generally better — but it is worth noting that diminishing returns set in at reasonable lengths. A password of 20 random characters from a 94-character set has approximately 131 bits of entropy. A 40-character version has 262 bits. The first is already well beyond what any practical attack could crack in any timeframe measured in human lifetimes. The second provides no additional practical protection.

The relevant length target is "long enough to be effectively uncrackable given current and near-future hardware." For random passwords, this is typically 16–20 characters. Going longer does not hurt, but the focus on length can become a distraction from the more important properties: uniqueness per site and true randomness.