Most of us have been stuck on a login screen wondering whether the "s" was a $ or the "o" was a 0. For years we were told a strong password should look like Pa55w0rd!. The trouble is, the software attackers use is far better at guessing those swaps than we are at remembering them. It's time to swap the "complex" password for a passphrase.
The passphrase
A few random words beat a jumble of symbols
A passphrase is just a short sentence or a handful of unrelated words. Rather than P@ssw0rd123, try something like PurpleOtterBakesBread.
Easier to remember
Our brains are built for words and pictures, not random characters. An odd mental image like a purple otter baking bread sticks far better than wondering whether the ! came before or after the 2.
Length is what matters
How hard a password is to crack depends mostly on how long it is, not how strange its characters are. Each extra character multiplies the number of guesses an attacker's software has to make.
Minutes versus centuries
Pa55w0rd! is only 9 characters, and modern cracking tools can often get through something like it in minutes. PurpleOtterBakesBread is 21 characters of plain words, and there are so many possible combinations at that length that guessing it would take centuries.
Old advice
Why changing your password every 90 days no longer helps
We used to be told to change passwords every few months, just in case. Security experts now agree that forcing regular changes makes people less secure, because it pushes them into two bad habits.
Predictable patterns
When Spring2025! has to change, it usually becomes Summer2025!. Attackers know this and try those patterns first.
Writing them down
Invent a new complicated password every month and it tends to end up on a sticky note on the monitor, or in a file on the desktop.
The modern rule: use a long, strong passphrase for each system, and only change it if you think someone else might know it.
Is your system still making you change your password every few weeks? Email us and we'll help you move to a more modern, secure setup.
What to do now
Three things you can do today
Go long
Aim for at least four random words, or a sentence of 15 characters or more.
Use a password manager
Let an app remember all your long passwords, so the only one you need to remember is its master password.
Check your settings
If your organisation still forces you to change your password every few weeks for no reason, talk to us.
Even the best password can be stolen, so turn on multi-factor authentication too.
Want help with passwords or security?
We can check your settings and help your team move to passphrases and a password manager.