iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Short, common, predictable, reused, or previously exposed passwords can put multiple accounts at risk. If attackers obtain a password from one service, they may try it on other services where it was reused. Use a password manager to generate unique passwords, enable multifactor authentication (MFA) or a passkey where available, and change a password when there is evidence it was compromised.
What makes a password poor?
A password is risky when it is short, easy to guess, reused on other accounts, or already exposed in a breach. A symbol or capital letter does not automatically make a password strong if the whole value is common or predictable. Attackers can try known passwords and predictable variations; a unique password limits the chance that one exposed credential will unlock another account.
The scale of breaches makes this a practical concern, but it does not show how many passwords were exposed. NIST reported that the Identity Theft Resource Center counted more than 3,000 data breaches in 2024, potentially exposing hundreds of millions of online accounts. That figure is about breaches and potential account exposures, not a count of password breaches or proof that any particular password was compromised. NIST’s password guidance was updated August 20, 2025.
Why does password reuse put accounts at risk?
When a service is breached, exposed credentials may be tried against other websites and apps. NIST describes this as password stuffing: a password compromised at one site is tested against other accounts. Reusing a password therefore connects accounts that would otherwise have separate credentials. Unique passwords prevent a leaked password from being a direct match for your other logins.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How long should a password be?
If you have to create and remember a password yourself, NIST’s public guidance recommends at least 15 characters. A passphrase—a longer sequence of words—can be easier to remember than a short password with arbitrary symbols. Avoid basing it on public personal details or a familiar phrase that others could guess.
NIST’s current SP 800-63B-4, dated July 2025, sets requirements for covered verifiers, not a universal rule for every consumer website. It requires a minimum of 15 characters for a single-factor password; for a password used only as part of MFA, a covered verifier may allow a minimum of eight. The standard also calls for checking proposed passwords against commonly used, expected, or compromised values and for rate limiting attempts.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
How can a password manager help?
A password manager can generate and store a different password for each account, so you do not have to memorize them all. NIST’s consumer recommendation is direct: “Use a password manager.” Its current standard also says, “Verifiers SHALL allow the use of password managers and autofill functionality.” That requirement applies to systems covered by the standard, not necessarily every site you use.
Recommended Free Tools
Protect the manager itself with a long master passphrase and turn on MFA if the manager supports it. The master secret protects a valuable collection of credentials, so use a unique one rather than reusing a password from another account. Keep a recovery method available and understand how you would regain access before relying on the vault as your only record.
Should you change passwords regularly?
No arbitrary calendar schedule is needed. NIST SP 800-63B-4 says, “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically,” and “Other composition requirements for passwords SHALL NOT be imposed.” These requirements apply to covered verifiers; they are not a guarantee about the policies of every website.
NIST’s rationale is that forced changes can lead people to make predictable edits, such as adding an exclamation mark, or choose weaker passwords when they expect another change soon. Change a password when there is evidence it was compromised—for example, a service reports a breach affecting your account—or when you discover it was reused or exposed. Make the replacement unique.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
What should you use in addition to a password?
MFA adds another layer: an attacker who has your password may still need a second proof of identity. NIST notes that MFA methods differ and that text-message codes are particularly vulnerable. Use a stronger method the account and your devices support, and make sure you understand its recovery process.
A passkey is another option where a service supports it. NIST says passkeys do not require memorization and are less susceptible to phishing than passwords. A physical security key can also serve as an MFA authenticator, but compatibility depends on the account, device, and service. There is no universal choice that works for every account, so check support and set up a recovery option before removing access to an existing sign-in method.
What should you do if a password may be compromised?
- Change the affected password. Use the service’s official app or website, and choose a new, unique password—preferably one generated and stored by a password manager.
- Replace reused copies. If you used that password on other accounts, change each one to a different password. Start with important accounts such as email, which may be used to reset other logins.
- Enable MFA or a passkey. Choose an option supported by the service and your devices; confirm that account recovery is set up.
- Review account activity. Check the service’s available sign-in history and security settings for unfamiliar activity, and follow its official instructions if you find anything suspicious.
A strong password does not stop every attack. Phishing can trick people into revealing credentials, and other attacks can target accounts in different ways. Treat a unique password as one important control, not a guarantee of account safety.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
