Fix Your Password Habits: The Rules That Actually Work in 2026

You reuse a password you can remember, add a number or symbol when a site complains, and change it only when you are locked out. That system feels practical, but it is exactly what attackers count on. One site leaks, that password is tried automatically against your email, bank and shopping accounts, and a small breach becomes a takeover everywhere. Fixing this does not mean memorising dozens of complicated strings. It means changing a few rules, in the right order, and letting tools do the remembering.

Rule 1: Length beats cleverness

Forget the old recipe of a short word with a capital letter, a swapped symbol and a number at the end. Cracking tools try those patterns first, because almost everyone builds passwords that way. Current guidance from NIST, the United States standards body behind the main digital identity guidelines, puts length first and drops mandatory complexity rules. A long password gives an attacker far more combinations to work through than a short one packed with symbols.

Use it in two forms. For passwords a manager will store, use at least 16 random characters. For the few passwords you must remember, such as your manager master password, use a passphrase of five or six unrelated words chosen at random. Do not use a quote, a song line or a family name. Random words are strong because they are unpredictable, not because they are meaningful to you.

Rule 2: Every account gets its own password

Uniqueness matters as much as length. A strong password reused on ten sites is only as safe as the weakest of those ten sites. If one of them stores passwords badly and leaks, your password is out, and automated credential stuffing will test it against other services quickly and quietly.

This rule makes a password manager non-negotiable. No one can remember a different long password for every shop, forum, bank and work tool. A manager can. It generates the password, stores it in an encrypted vault, and fills it only on the right site. Your job shrinks to one strong master passphrase, plus a second factor on the manager itself.

Generate fresh passwords with our Password Generator. It runs in your browser, uses a cryptographic random source, and does not send or store what it creates. Generate, save it straight into your manager, and only then confirm the change on the site.

Rule 3: Fix the important accounts first

Do not try to clean up every login in one evening. Work in this order instead.

First, your main email account. Password resets for almost everything else land there, so whoever controls your email can often reset their way into the rest of your life. Give it a unique, generated password and the strongest second factor it offers. Second, your password manager itself. Third, banking, payment and government accounts. Fourth, work accounts and accounts holding files, photos or private messages. Only then work through shopping and social accounts as you sign in to them over the next few weeks.

As you go, delete accounts you no longer use if the service lets you. A forgotten account still counts if that service is breached.

Rule 4: Stop rotating, start reacting

Changing every password on a fixed schedule sounds careful, but modern guidance advises against forced periodic changes when there is no sign of trouble. Scheduled changes push people toward tiny, predictable edits, such as raising the number at the end by one. A password that stays strong and secret beats a series of weak variations.

Change a password straight away when you have a real reason: a reported breach, a possible exposure, sharing it with someone who no longer needs it, typing it on a device you do not trust, or your manager flagging it as reused or weak. Afterwards, sign out other sessions if offered, and check your recovery email and phone are still yours.

Rule 5: Add a second layer that is not just a text message

Even a perfect password is still a single secret that can be phished, leaked or guessed after enough tries. Turn on two-factor authentication or multi-factor authentication wherever it is offered, starting with email, banking and your manager.

Prefer, in order, a passkey or hardware key if offered, then an authenticator app, then a text message code if nothing better exists. A text code is better than nothing, but it depends on your phone number, and numbers can be moved or hijacked in ways an app or passkey cannot.

Rule 6: Use passkeys where they are offered, keep passwords where they are not

A passkey replaces a password with a cryptographic key pair on your device, unlocked by fingerprint, face or device PIN. There is no shared secret for a fake login page to steal, and nothing to remember or type. Apple, Google and Microsoft now support passkeys, and more services add them each year.

That does not make passwords obsolete today. Many sites still offer only passwords, and many passkey setups keep a password as a fallback. The habit for 2026 is simple: create a passkey when a trusted service offers one, keep the account password unique and stored in your manager anyway, and do not remove your fallback until you understand how that service handles recovery if you lose your device.

What not to store, and where not to store it

Do not keep passwords in a notes app, a spreadsheet, an email to yourself, or a desktop document. Those places are not built to protect secrets. Do not paste a real password into a checker that sends it to a server. If a tool works entirely in your browser, as our Password Generator does, you can test that by loading the page, disconnecting from the internet, and generating anyway.

The one sensible exception is writing your manager master passphrase and recovery codes on paper and keeping that paper physically secure at home. That is very different from a sticky note on a monitor in a shared space.

What to do first

Today, do three things only. Set a long, random passphrase as your password manager master password, with a second factor on. Change your main email password to a fresh, generated one of at least 16 characters, with its strongest second factor or passkey. Then change one money account the same way. After that, fix one or two accounts a day as you use them, always generating, never inventing, and never reusing. Within a few weeks the new system will be easier than the old one.