Do this
Why it’s outdated
Rules that demand a mix of capitals, numbers and symbols push people toward predictable patterns like “Summer2026!”, which attackers try first. Length and randomness matter more. NIST’s current guidelines say services must not require character mixes, and they set a minimum of 15 characters for a password used on its own. The UK’s National Cyber Security Centre recommends three random words.
Common questions
Modern research shows that the most important factor in a strong password is length, not complexity (sometimes called “composition”). The government agency that sets standards, NIST, updated its guidance in 2017, noting that long passwords and passphrases are harder for attackers to crack in offline attacks. Its 2025 update goes further: services must not require mixes of character types or periodic password changes. A long, unique password that is randomly generated and stored in a password manager gives you far more protection against common attacks than short strings filled with symbols. Unfortunately, many services still require complexity rules that you cannot change, so you will still need to follow those when they appear. But whenever you have the choice, choose length and uniqueness, and let a password manager handle the rest.
Here’s the 2017 NPR article explaining the NIST change.
To get a sense for how long it takes for advice to change, the classic XKCD comic strip (“correct horse battery staple”) was published in August of 2011.
Do this instead
Let a password manager create long, random passwords, including for sites that still insist on symbols or numbers. Use a passphrase of random words for the few you must remember.
Do this