Strong passwords you can remember, and when to change
A strong password today is a long one that you use for a single account, not a short one full of symbols that you change every three months. Official guidance in the US, the UK, and Canada now favors length and uniqueness, and recommends changing a password when there is a reason to, such as a breach, rather than on a fixed schedule.
How to create a strong password you can still remember
The short answer: make it long, make it different for every account, and let a password manager remember all the ones you do not need to type yourself. This page is about the few passwords you still have to remember, and it belongs to our guide to storing your logins safely. The rules most of us learned, with a capital letter, a number, a symbol, and a change every 90 days, have been dropped by the US National Institute of Standards and Technology in its digital identity guidelines, SP 800-63B, revised in 2025.
Why the change? Composition rules produce passwords like Summer2026! that are hard for people and easy for attackers, who know exactly which substitutions people make. Forced changes produce Summer2026! followed by Autumn2026!. Length and uniqueness do more, and they are easier to live with.
What the official guidance says, country by country
The agencies agree on the direction but not on the numbers. Note that NIST writes for the people who build login systems: its figures tell services what to require, not what you must type.
| Source | Length | Complexity rules | Regular changes | Other advice |
|---|---|---|---|---|
| NIST SP 800-63B, revision 4 (US, July 2025), for online services | At least 15 characters when the password is the only factor; at least 8 with a second factor | Services shall not impose them | Services shall not require them, but shall force a change after evidence of compromise | Services shall allow password managers and should allow pasting |
| CISA, guidance for businesses (US) | At least 16 characters, or a passphrase of five to seven unrelated words | Mix of characters, or a passphrase | Not covered | A password manager for the whole company, plus phishing-resistant multifactor authentication |
| NCSC (UK) | No fixed number | Three random words | Change a password quickly if you reused it elsewhere | Writing a password down is acceptable if you keep it somewhere safe |
| Canadian Centre for Cyber Security (Canada, 2024) | At least 12 characters, or a passphrase of at least four words and 15 characters | Not required for passphrases | Not covered in the pages we read | Keep banking and email passwords out of password managers |
| Australian Cyber Security Centre (Australia) | Publishes passphrase guidance | Not checked | Not checked | Its website did not respond when we checked on November 10, 2026 |
Sources: NIST SP 800-63B-4, section 3.1.1.2; CISA, “Require strong passwords”; NCSC, “Three random words”; Canadian Centre for Cyber Security, ITSAP.30.032. All checked on November 10, 2026.
The passwords you still have to remember
Even with a password manager, a few passwords stay in your head:
- the one that opens the password manager itself;
- the one you use to sign in to your computer, if it asks for a password rather than a PIN or your fingerprint;
- in Canada, if you follow the Cyber Centre’s advice, your banking and email passwords.
Everything else can be a random string generated and stored by the manager. You never need to see it.
How to build one in two minutes
The method the NCSC promotes works because it produces long passwords that are easy to picture:
- Pick three or four words that have nothing to do with each other or with you: no children’s names, no team, no street. A dictionary opened at random pages works better than your imagination.
- Join them, with or without spaces: something like
copper lantern meadow ferry. - Check the length against the table above: four ordinary words usually pass 20 characters.
- Do not swap letters for look-alike symbols, such as an
ofor a0. The NCSC points out that criminals know these tricks. - Use it for one account only, and turn on a second factor for that account.
The example above is now published, which means it is no longer a good password for anyone. Make your own.
How often to change it
Change a password when you have a reason to: a breach notice from the service, a warning from your password manager, a login you do not recognize, a device that was lost, or a person who knew it and left your team. NIST tells services not to impose regular changes but to require one after evidence of compromise. If you reused a password, change it everywhere it appears, starting with your email account, as the NCSC advises.
A forced change every few months makes sense only where your employer or a regulation still requires it. If you run the business, you can stop imposing it on your team.
Do not reuse it, even “just for unimportant sites”
Reuse is what turns one leak into many break-ins. A forum you joined years ago may store passwords badly; if your password leaks from there, attackers try it on email services, banks, and cloud storage. NIST’s guidelines call this “password stuffing” and list distinct passwords as the defense. The only practical way to keep dozens of distinct passwords is a password manager, which is why the rest of this series exists.
Is the vault itself a risk?
Putting every password in one place raises a fair question about what happens if the vault is breached. Our page on whether a password manager can be trusted explains what the encryption protects and how to protect the vault’s own password.
Choosing where your passwords will live
Once you have one strong password to remember, you need a place for all the others. If you are unsure between the manager in your browser and a separate app, start with the built-in options compared with dedicated apps.