Passwords and passkeys

Since July 2025 the US standard NIST SP 800-63B-4 has said a password used on its own must be at least 15 characters, and that services must not force you to change it on a schedule.

"Summer2024!" ticks every box. So why is it weak?

Many people still believe a strong password needs a capital letter, a digit and a symbol, and that changing it every 90 days keeps it safe. Sign-up forms taught exactly that for years. Look at what the rules produced. "Summer2024!" meets all of them. Ninety days later it turns into "Autumn2024!", and anyone who saw the first one can guess the second. The rules made passwords harder to remember without making them much harder to guess.

What the 2025 US standard asks for instead

The current US guideline, NIST Special Publication 800-63B-4, finalised in July 2025, turns those habits around. A password used on its own must be at least 15 characters. If it is only one part of a multi-factor login, the minimum is 8. Services should allow at least 64 characters and accept spaces and all printable characters, and they must not impose other composition rules such as "one symbol". They must not force periodic changes either. A change is required only when there is evidence the password has leaked. NIST also asks services to compare every new password against a blocklist of common, expected or already-leaked passwords, because a password that has appeared in a breach is no longer secret, however long it is.

Counting what a guesser has to get through

Why does length win? Each extra character multiplies the number of possible passwords. Eight lowercase letters give 26 to the power 8, about 209 billion combinations. A computer testing a stolen password file works through that quickly. Four words picked at random from a list of 7,776 give about 3.66 × 10¹⁵. The table shows how fast the counts grow, and the code exercise further down lets you compute two of them yourself.

Why one leak spreads to other accounts

CISA, the US cybersecurity agency, sums up a strong password in three words: long (at least 16 characters), random, and unique to each account. Random can mean a string of mixed characters or a passphrase of four to seven unrelated words. Unique matters most of all. When one site leaks, criminals try the same email and password on other sites, so a reused password turns one breach into many. Nobody can remember dozens of long random passwords. That is why both CISA and NIST support password managers, programs that generate, store and fill passwords so you remember only one. NIST says services must allow password managers and autofill, and should allow paste.

A passkey leaves nothing to type and nothing to steal

A passkey replaces the shared secret with public-key cryptography. MDN describes it as a key pair bound to your account on one website. The private key stays in an authenticator on or attached to your device, and you open it with your device PIN, fingerprint or face. The public key sits on the website's server. To sign in, the site sends a challenge and your device signs it. Nothing secret is typed. Nothing secret is stored on the server either, so a server breach leaks nothing reusable. Each passkey is also tied to the site's domain, which means a look-alike phishing page cannot use it. NIST counts this kind of cryptographic login as phishing-resistant and passwords as not, and it allows passkeys that sync between your devices.

Where to start? Give your email account a long passphrase first, because the email account can reset the others. If you use a password manager, that passphrase becomes the one password you memorise. Then change every password you know you have reused, beginning with banking and shopping accounts. When a site offers to create a passkey, saying yes is usually the quickest upgrade. You can keep the password as a fallback.