A Short, Honest Guide to Password Security in 2026

Password advice has been a mess for twenty years. We have been told to include a capital letter, told to swap letters for symbols, told to memorise a different password for every site, told to change all of them every ninety days. Much of that advice is either outdated or actively unhelpful in 2026.

This piece cuts through it. It covers how modern credential attacks actually work, what a strong password looks like now, and why the combination of a good generator and a password manager has quietly become the only advice worth repeating.

How passwords actually get cracked

There are three mechanisms that account for almost every real-world account breach:

• Credential stuffing. A password leaks from one site, and the same combination is tried on hundreds of others. Reuse is the single biggest risk.
• Phishing. An attacker tricks a person into typing their password into a fake login page. Length and complexity do not help here at all.
• Offline brute force against a leaked hash. If a site's database is dumped, the attacker spends GPU time guessing against the hashes. This is where password length matters enormously.

Two of these three — reuse and offline cracking — are fully solved by a generator and a manager. Phishing is the one that still requires human judgement and, increasingly, a passkey or hardware key.

What actually makes a password strong

Strength is measured in entropy: the number of possible passwords an attacker would need to try. Entropy depends on two things:

• The size of the character pool you draw from (lowercase, uppercase, digits, symbols).
• The length of the password.

Length dominates. A twenty-character password drawn only from lowercase letters is stronger than a ten-character password with every symbol on the keyboard. This is why modern guidance from NIST and most security teams has dropped the "must contain a special character" requirements in favour of long passphrases.

A practical minimum for 2026: 16 characters, randomly generated, drawn from a mixed pool. That is comfortably beyond what offline cracking hardware can brute force in any realistic timeframe.

The "clever pattern" trap

Leetspeak substitutions — P@ssw0rd, 5ecur1ty, H3llo! — were never meaningfully strong, and are weaker now than they were a decade ago. Cracking tools have had these rules built in since at least 2012. A dictionary word with predictable substitutions is, from the attacker's perspective, barely different from the dictionary word.

The same applies to personal patterns: your dog's name plus your birth year, the street you grew up on plus an exclamation mark. Anything a friend could guess in five minutes, a tool can guess in five milliseconds.

Why a generator is the simplest fix

A proper password generator draws from a cryptographically secure random source — in the browser, that is the Web Crypto API. There is no pattern to spot, no dictionary word to guess, no clever structure to exploit. Our own password generator uses exactly this source, with rejection sampling to avoid subtle biases that appear when you use naive modulo arithmetic.

Generating is only half the job. A random 20-character password is stronger than anything you could memorise, but it is also unmemorisable by definition. That is where a password manager picks up.

Password managers are the real answer

A password manager remembers one strong password — your master password — and handles everything else. It fills in credentials automatically, which has the side benefit of defeating most phishing: the manager will not auto-fill a password on a fake domain, because domains do not match.

The main open choices in 2026 are 1Password, Bitwarden (with a generous free tier), and the built-in managers in iOS, Android and major browsers. Any of them is dramatically safer than trying to remember passwords. The specific choice matters far less than the decision to use one at all.

Multi-factor authentication and passkeys

Two-factor authentication — the six-digit code from an app — is the single biggest upgrade you can make after switching to generated passwords. It defeats credential stuffing almost entirely, because a stolen password alone is not enough.

Passkeys, built on the FIDO2 / WebAuthn standard, are the step beyond that. They use public-key cryptography tied to your device, so there is no password to leak and no code to phish. Where a site supports them, they are the safer default.

Final checklist

• Use a password manager for every account you care about.
• Generate passwords of at least 16 characters with a secure random source.
• Turn on two-factor authentication, preferably via an authenticator app, not SMS.
• Prefer passkeys over passwords wherever a site offers them.
• Treat any "password complexity" requirement as a box to tick, not a security strategy.

None of this is complicated. It is a one-evening project that pays back for years. Start with the accounts that hold everything else — your email and your password manager itself — and work outwards from there.