The Password Rules I Used to Follow That Weren't Actually Helping

The Password Rules I Used to Follow That Weren't Actually Helping

For years I followed a set of password rules that felt like common sense, the kind of advice that gets repeated so often nobody stops to check if it's actually true anymore. Some of it came from IT departments, some from old security training, some from just picking up what everyone else seemed to be doing. Most of it wasn't wrong exactly, it was just outdated, or it solved a problem that stopped mattering years ago while ignoring the one that actually put me at risk. Here's what I used to believe, and what changed once I actually looked into why.

Adding a Symbol Doesn't Make a Weak Password Strong

I used to think swapping a letter for a number or bolting an exclamation mark onto the end of a password was what made it secure, because that's what most sign-up forms seemed to reward. In practice, a short password with a symbol tacked on is barely harder to crack than the same password without it, since the tools used to guess passwords already account for the obvious substitutions everyone makes. Length is what actually slows an attacker down, not the character set. A long passphrase built from a few unrelated words takes dramatically longer to crack than an eight-character jumble of symbols, even though the jumble looks more complicated to a human eye. I've written separately about the actual method I use to build a password worth trusting, and length-over-complexity is the first thing that changed once I understood how the maths actually works.

Changing My Password Every Few Months Was Making Things Worse, Not Better

For a long time I assumed that rotating my passwords regularly was just good hygiene, something a careful person did without being asked. It turns out forced periodic changes tend to push people toward weaker patterns, not stronger ones, because remembering a new arbitrary string every ninety days is hard, so people start incrementing a number at the end or cycling through a small set of variations that are trivial to guess once one version leaks. A password only actually needs changing when there's a real reason to believe it's been exposed, not on a fixed calendar. Security guidance has moved away from mandatory rotation for exactly this reason, and I stopped forcing it on myself once I understood the pattern it was encouraging.

A Text Message Code Isn't the Same Protection as an Authenticator App

I used to treat any form of two-factor authentication as equally secure, on the logic that a second step is a second step regardless of how it arrives. A code sent by text message can be intercepted through SIM-swapping, where someone convinces your mobile provider to move your number onto a SIM card they control, and from that point every text-based code goes straight to them instead of you. An authenticator app generates the code locally on your device instead of sending it over the mobile network, which closes off that specific attack entirely. I've written separately about the different kinds of two-factor authentication and which one I actually trust, and SMS codes are still better than no second step at all, they're just the weakest version of one available.

Reusing a Strong Password Across a Few "Safe" Sites Still Isn't Safe

I used to make an exception for a handful of sites I considered low-stakes, reusing one strong password across a forum, a newsletter sign-up, a one-off shopping account, on the logic that nothing sensitive lived there anyway. The problem is that a password is only ever as safe as the weakest place it's used, and a low-stakes site is often exactly the kind of place that gets breached without much fanfare, since it has less reason to invest in serious security than your bank does. Once that password leaks, it's the first thing tried against every other account you own, sensitive or not. A password manager like NordPass removes the temptation entirely by generating and storing a genuinely unique password for every single account, so there's never a "safe enough to reuse" exception to make in the first place.

My Fingerprint or Face Unlocking My Phone Isn't Actually a Password

I used to think of biometric unlock as a stronger version of a password, since it's tied to something only I physically have. It's more accurate to think of it as a convenience layer sitting on top of a password, not a replacement for one. A fingerprint or face scan can occasionally be fooled by a good enough replica, and in some jurisdictions you can be legally compelled to unlock a device with your face or thumb in a way you can't be compelled to hand over a memorised password, since a password is treated as something you know rather than something you are. I still use biometric unlock for everyday convenience, but I make sure the underlying passcode behind it is one I'd actually trust on its own, not an afterthought I never think about because I stopped typing it in.

None of these rules were things I made up carelessly, they were the advice that was floating around when I first started paying attention to this, and most of it made sense at the time or came from somewhere reasonable. The gap between what felt secure and what actually was secure only became obvious once I looked into why each rule existed in the first place. The NCSC publishes its own guidance on password best practice if you want to check your own habits against it, and my free Safety Toolkit covers the account-level basics that sit alongside everything here. Getting the actual reasoning right changed more about how I handle logins than any single new tool ever did.