What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A strong password is long, hard to guess, and used for only one account. A password manager can create and remember a different password for each service, while multi-factor authentication (MFA) adds another layer if a password is stolen. For personal accounts, you generally do not need to change a good password just because it is old: change it promptly if a service reports a breach or you have other evidence it was exposed, and replace any reused or closely similar passwords too.
What makes a password strong?
Password strength comes primarily from length, unpredictability, and uniqueness. Each quality addresses a different risk: a longer password is harder to guess, an unpredictable one is less likely to be found in common-password lists or inferred from personal details, and a unique one limits the damage if a service is breached.
Think of these as three separate checks, not competing techniques. A long password that is a familiar quotation may be predictable. A complicated-looking password reused on several sites can still put every one of those accounts at risk. A strong choice needs to be difficult to guess and reserved for just one account.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Choose length you can maintain
The Federal Trade Commission (FTC) advises consumers to aim for at least 12 characters. It suggests using a passphrase made from random words if that is easier to remember, and cautions against familiar quotations or common phrases. A memorable sentence or quotation may feel long but can still be predictable if it is widely known.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
NIST’s current standard sets a different kind of number: covered services must allow passwords of at least 15 characters when a password is the only authentication factor, and at least 8 characters when it is used only as part of MFA. These are minimum requirements for services (verifiers), not a universal instruction that every person must use exactly one length or change an existing password. The FTC’s consumer target and NIST’s service requirements have different purposes, so they should not be treated as competing measurements. See the FTC password guidance and NIST SP 800-63B-4.
In practical terms, the FTC’s 12-character target is consumer advice, while NIST’s 15-character figure is a requirement for services that fall under the standard when passwords are used alone. NIST’s 8-character minimum applies only when the password is one part of MFA. These figures describe different contexts: the NIST numbers tell covered services what they must permit, not how a person should interpret every password they already have. If you are creating a new password, longer is a sensible aim when the service allows it.
Random words can make a passphrase easier to remember than a string of unrelated symbols, but randomness matters. Avoid well-known phrases, lyrics, quotations, or a sequence that someone could guess from public information. If remembering a unique passphrase for every service sounds impractical, a password manager can create and retain the distinct passwords for you.
Make it unpredictable, not merely decorated
Adding a capital letter, number, or symbol does not automatically make a password hard to guess. NIST’s current rules tell services not to require a particular mix of character types, such as uppercase, lowercase, digits, and symbols. Instead, services must check new passwords against a blocklist of common, expected, or compromised values.
If a site still imposes its own character rules, follow them to create an acceptable password. But do not rely on predictable substitutions—such as changing a familiar word in a routine way—as a substitute for length and unpredictability. A random passphrase or a password-manager-generated string is generally more practical than trying to invent a clever variation of a familiar password.
This is why a password can satisfy a website’s symbol or capitalization rule without being a good choice. The rule may make the password acceptable to that particular service, but it does not make a familiar or reused password unpredictable. Conversely, NIST’s current standard does not call for every password to include a prescribed combination of character types. Where the site sets a requirement, meet it; beyond that, prioritize a long, distinct value that is not common or compromised.
Use a different password for every account
Never reuse one password across sites. If attackers obtain a password from one service, they may try it on other services. Reusing a password—or making only a small, predictable change to it—can turn one exposed account into a risk for several accounts. NIST discusses distinct passwords in its SP 800-63 FAQ and authentication standard.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Uniqueness is especially important because you cannot control how every service protects its account data. If one service reports that a password was exposed, the same credential should not open another account. A close variation is not a dependable workaround: if you have reused a password with only a small change, treat the other account as needing a genuinely different password too.
How to create and maintain strong passwords
Use a password manager for unique passwords
A password manager can generate and retain a long, distinct password for each account, so you do not have to memorize every one. Both the FTC and NIST recommend password managers as a way to select and maintain unique passwords. Protect the manager’s vault with a strong master passphrase, and enable MFA for the manager if it is available. The master passphrase is important because it protects access to the stored credentials.
- Choose a password manager. Use a service or tool you are comfortable relying on to store account credentials. This guidance does not rank particular products; the FTC and NIST describe the category’s role in managing unique passwords.
- Protect the vault. Set a strong master passphrase rather than reusing a password from another account. Turn on the manager’s available MFA.
- Replace reused passwords first. Start with accounts that share a password, or use close variations of one. Create a distinct password for each account and save it in the vault.
- Use generated passwords for new accounts. Let the manager generate a long, unique value where the site permits it. If a site has a length or character restriction, use a password that satisfies that site’s rules without reusing another account’s password.
The FTC’s consumer guidance and NIST’s FAQ explain the role of password managers. A manager makes distinct credentials manageable; it does not remove the need to protect the vault itself.
The practical benefit is that you do not have to choose between remembering one password for every account and trying to memorize a different complex string for each one. Let the manager handle the distinct credentials, and focus your memory on a strong master passphrase. Because that passphrase protects access to the vault, do not reuse it as an account password. Enable the manager’s MFA where available as another safeguard for access to the stored credentials.
There is no product comparison here: the research supports the general value of a manager for generating and maintaining unique passwords, but it does not evaluate or rank specific products. If you are choosing one, use a tool you are comfortable using consistently and check its compatibility with your devices, vault and recovery model, and MFA support. Those are useful decision factors, not a claim that one particular manager is best.
Add MFA where available
A strong password can still be stolen, for example through phishing. MFA asks for another check in addition to the password, which can provide protection if the password is exposed. Enable it on important accounts wherever the service offers it. NIST’s consumer password guidance includes security keys among possible MFA methods. A physical key is an optional account-protection tool, not a replacement for having a unique password for each account.
Follow the account provider’s setup and recovery instructions for the MFA methods it supports. The available choices and their recovery processes can vary by service; there is no single method that this guidance ranks as best for every account.
MFA is useful because a password is only one part of the account’s protection. A second check can help when someone has obtained the password, but it does not make reusing passwords a good idea. Keep each password unique, then add MFA as an additional layer where available. Security keys are one possible method mentioned in NIST’s consumer guidance; choosing one is optional and should fit the methods the service supports.
Free tools Windows power users keep installed
One-click scans. No signup required.
Should you change passwords regularly?
For an ordinary personal account, do not change a sound password on an arbitrary calendar schedule solely because it is old. NIST SP 800-63B-4 says that covered verifiers must not require periodic password changes, but must force a change when there is evidence the authenticator has been compromised. This is a standard requirement for services within its scope, rather than a promise that every website has identical rules.
Routine changes can also encourage people to make small, predictable edits instead of choosing a genuinely different password. A more useful approach for personal accounts is to keep passwords unique and change them when there is evidence of exposure or compromise. Some workplaces or services may set their own policies, so follow applicable organizational requirements for those accounts.
NIST’s wording is specific: “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.” The same section says that a verifier “SHALL force a change if there is evidence that the authenticator has been compromised.” These statements come from section 3.1.1 of NIST SP 800-63B-4, published in July 2025, and apply to the standard’s covered services. They do not mean every website follows the same policy, or that you should ignore a workplace rule that applies to your account.
For an individual deciding whether an old password needs changing, the useful question is not simply how many months have passed. Ask whether the password is unique, hard to guess, and known to have been exposed. If it is sound and there is no evidence of compromise, a recurring date by itself is not a reason to rotate it under NIST’s current guidance. If there is evidence of compromise, act promptly rather than waiting for the next scheduled change.
When to change a password—and what else to update
If a service reports a breach
Change the affected account’s password promptly if the company tells you it lost your password in a data breach. Use the service’s genuine site or app to make the change rather than following an unexpected link in a message. If that password was reused on another service, change the other account’s password as well; do the same for close variations. The FTC specifically advises changing reused or closely varied passwords after a breach report.
Make each replacement genuinely different, not just a minor edit to the exposed password. If the affected credential was unique, concentrate on replacing it for that account. If you used it elsewhere, those accounts need new, distinct passwords too; otherwise, the same exposure may still put them at risk.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
If you have other evidence it was exposed
A breach notice is not the only reason to act. If you have evidence that an account credential was compromised, change that password promptly. If the same or a similar password protects other accounts, replace those too. NIST’s standard requires covered services to force a change when there is evidence of compromise; the FTC’s consumer advice likewise makes exposure the trigger for an immediate password change.
If you have no evidence of compromise
If a password is long, hard to guess, unique to its account, and not known to be exposed, age alone is not a reason to rotate it on a schedule under NIST’s current guidance. Instead, address the more important weaknesses: replace reused credentials, use a password manager to maintain unique ones, and enable MFA where offered.
Recommended Free Tools
This advice is about the trigger for changing a password, not a promise that a service will never ask you to update one. A service or employer may have its own policy, and NIST’s requirements apply to verifiers within the standard’s scope. For personal accounts, the practical priority remains evidence of exposure, rather than a calendar reminder to make a routine variation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Practical checklist
- Use a long, hard-to-guess password for each account; the FTC consumer target is at least 12 characters.
- Do not reuse passwords or rely on a small variation between accounts.
- Use a password manager to generate and retain distinct credentials.
- Protect the manager’s vault with a strong master passphrase and available MFA.
- Enable MFA on accounts that offer it.
- Change an affected password promptly after a breach report or other evidence of exposure, and update reused or similar passwords too.
- Do not change a sound personal-account password merely because a routine date has arrived, while observing any applicable workplace or service policy.
Frequently Asked Questions
How often should I change my passwords?
For a personal account, you generally do not need to change a sound password just because it is old. Change it promptly if a service reports a breach or you otherwise have evidence that it was exposed. Also replace any reused or closely similar passwords on other accounts. Some workplaces and services set their own policies, so follow requirements that apply to those accounts.
How long should a strong password be?
The FTC advises consumers to aim for at least 12 characters. NIST SP 800-63B-4 requires covered services to allow at least 15 characters when a password is the only factor, and at least 8 when it is used only as part of MFA. NIST’s numbers are requirements for covered services, not a universal instruction to change every existing password.
Do I need uppercase letters, numbers, and symbols in every password?
Not necessarily. NIST’s current standard tells covered services not to impose character-mix rules such as requiring uppercase, lowercase, digits, and symbols. A site may still have its own requirements, so follow them, but prioritize a long, unpredictable password rather than relying on predictable substitutions or symbols.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhat should I do if a company reports a password breach?
Change the affected account’s password promptly. If you reused it or a close variation on another service, change those passwords too and make each replacement distinct. Use the service’s genuine site or app to make the change.
Does MFA mean I can reuse a password?
No. MFA adds another check if a password is stolen, but each account should still have a unique password. Turn on MFA where available, and consider a security key if it is among the methods the account supports.
The Bottom Line
Choose a long, unpredictable password unique to each account; use a password manager to make that practical, and enable MFA where available. For personal accounts, change a password when there is evidence it was exposed—not simply because it has reached an arbitrary age. After a breach, replace the affected password and any reused or closely similar ones.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
