Passwords: what actually matters today

For twenty years, the same instruction was repeated: a password must be complicated, contain an uppercase letter, a digit, a symbol, and change every three months. This instruction is now considered outdated, and by the very people who wrote it.

Current recommendations, notably the NIST’s reference publication on authentication (SP 800-63B), say almost the opposite. They are simpler to apply, and they protect better. Here is what has changed, and what it concretely means for an SME.

Should a password be long or complex?

A password resists an automated attack in proportion to the number of combinations an attacker must try. Every additional character multiplies this number, whereas a symbol added to a short word only shifts it slightly.

Compare Kx7#pQ! with chair cloud whirlwind lamp. The first looks serious, it is short and you will not remember it. The second is a passphrase: four unrelated words, very long, instantly memorable. It is the second one that resists best.

Two conditions matter. The words must be chosen at random, not form a known expression or a phrase that makes sense to you. And the phrase must contain no information about you: your children’s names, your dog’s name, your date of birth, your company’s name. These details often appear in plain view on social media and in the lists that attackers try first.

Our password tester lets you compare the two approaches. It works entirely within your browser: nothing is transmitted, nothing is stored.

Imposed rules produce the opposite effect

Requiring an uppercase letter, a digit and a symbol seems prudent. In practice, this rule produces surprisingly uniform passwords. The uppercase letter goes at the start, the digit and symbol at the end, and you end up with the family Password2026!, Welcome2026!, Company2026!. Attack tools know these patterns perfectly and test them first.

The rule has a second effect, even more damaging: it makes passwords painful to remember, so people write them down. On a notepad, in a file, on a label stuck under the keyboard. The constraint meant to strengthen security ends up undermining it.

Forced periodic change suffers from the same flaw. Required to change every three months, an employee does not reinvent their password, they let it drift. Fribourg2026-1 becomes Fribourg2026-2. An attacker who obtained the old one guesses the new one without effort.

The real danger is reuse

Here is the point most business owners underestimate. The strength of a password matters far less than the number of places where it is used.

The mechanism is simple. Some online shop gets hacked and its database of credentials starts circulating. Programs then automatically replay each address-and-password pair against hundreds of services: business mailboxes, online banking, line-of-business tools, remote access. This is called credential stuffing. The attacker has not broken anything at your end, they have simply logged in.

This is often how a business e-mail compromise begins, which in turn leads to transfer requests sent to your accounting department. To find out whether your addresses already appear in known leaks, use our password leak check tool. The risk increases further when these credentials are typed in from a personal computer or a public wifi network, a situation covered in our article on remote work and mobile devices.

Is a password manager too risky?

No one can remember forty different passphrases. A password manager is an encrypted vault that remembers them for you, generates them at random and fills them in automatically on forms. You only need to remember one password: the one that opens the vault.

The objection comes up every time, and it is justified: doesn’t putting all your passwords in the same place create a single point of failure? Technically, yes. But the honest comparison is not with a flawless memory, it is with the real situation: three passwords recycled across thirty services, a spreadsheet called “access” on a shared drive, and credentials exchanged by e-mail.

The manager concentrates the risk, but it concentrates it in a place designed to withstand it: content encrypted on your device, a publisher unable to read your data, access protected by a second verification step. Three precautions make this choice a reasonable one.

• A long master passphrase, used nowhere else.
• Two-factor authentication activated on the vault, without exception.
• A recovery key printed and stored physically, outside the system.

Automatic form filling also brings an unexpected benefit: the manager only offers your credentials on the exact domain they are associated with. On a phishing site imitating your bank, the field stays empty. This silence is a useful warning sign, as our article on phishing explains.

How should an SME manage shared passwords?

Every SME has its collective accounts: access to the website, the social media account, the supplier portal, the info@ mailbox. They generally circulate by message, end up in a shared document, and no one really knows anymore who has them. When an employee leaves, they stay unchanged.

Three steps are enough to clean up the situation.

Eliminate sharing when possible. Many services offer individual accounts with distinct roles and rights. This is always preferable: every action is attributable, and a person’s departure is handled by disabling their access, without disturbing anyone else.

Share through the vault when that is not possible. Professional managers offer team folders. The password is made available without being revealed, access is granted and withdrawn in one click, and you have the list of people concerned.

Treat departures as a security event. The day someone leaves the company, their individual access is disabled and the shared passwords they knew are renewed. This is also generally when the scale of the problem comes to light. The mirror image of this list plays out at hiring: it is the best moment to instil the right habits, as our article on a new employee’s arrival explains.

Where the work goes beyond what you can do alone

Choosing a manager, installing it and training the team is perfectly within reach of an SME. Allow half a day, and the result already fends off the majority of automated attacks. Do not deny yourself this gain just because the rest is imperfect.

The real difficulty lies elsewhere. It begins when you have to take stock of what already exists. How many accounts does your company actually have? No one knows exactly, and that is normal. There are the services subscribed to by an employee who left three years ago, the access opened by a contractor during a project that has since ended, the technical accounts created when a piece of software was installed and never touched since, the secondary mailboxes, the access to administrative portals.

It is these forgotten accounts that cause problems, precisely because they are forgotten. They appear in no procedure, no one watches their logins, and they often keep old, weak and reused passwords. A manager rolled out on the twenty accounts people remember leaves the other forty untouched.

Drawing up this inventory, determining who accesses what, closing what no longer serves a purpose and checking that the rights granted match actual roles is methodical work. Few SMEs see it through without help, not out of negligence, but because it requires knowing where to look. The measures described here form a solid foundation, they do not replace this review of your own situation.

To gauge your overall level, the cyber check-up devotes several questions to access. The other priorities are grouped in the 10 essential measures and in the Best practices pillar.