What doesn't matter as much as you think
- Forced regular password changes. Studies on this (including from Microsoft's identity security team) found that forcing frequent changes leads people to make small, predictable tweaks to the same password — which is easier, not harder, to guess.
- Complex symbol requirements alone. "P@ssw0rd1!" satisfies most complexity rules and is one of the first guesses in any password-cracking tool. Complexity rules without length requirements don't add much real protection.
What actually causes account takeovers
Almost every real-world account compromise traces back to one of three causes — not a "weak" password in the way people usually imagine:
1. Password reuse across sites
When one service you use gets breached (and large breaches happen constantly, often without much news coverage), the leaked email/password combinations get tried automatically against thousands of other sites — this is called credential stuffing. If you reused that password on your email or bank, that account is now compromised too, with no "hacking" required at all.
2. Phishing — you handing over the password yourself
No password, however strong, protects you if you type it into a fake login page. This is why phishing awareness (see our guide on fake KYC SMS) matters more than password complexity for most people.
3. No second factor
A leaked or guessed password is only the whole story if there's nothing else standing between it and your account. Two-factor authentication (2FA) is the single highest-leverage security habit available to an average person.
What to actually do
- Turn on two-factor authentication on your email, banking apps, and social media — prefer an authenticator app (Google Authenticator, Microsoft Authenticator) over SMS-based 2FA where available, since SMS can be intercepted via SIM swap.
- Use a unique password for every important account — especially email, since it's usually the recovery path into everything else. A password manager (built into Chrome, iOS, and Android, or standalone apps like Bitwarden) makes this practical without memorising dozens of passwords.
- Make your passwords long, not necessarily complex — a random phrase of 4-5 unrelated words is harder to crack than a short string of symbols, and easier to remember.
- Check if your email has appeared in a known breach using a reputable checker like haveibeenpwned.com, and change reused passwords for any accounts flagged.
The one account worth protecting hardest
Your primary email account is usually the recovery mechanism for every other account you own — banking, social media, shopping. If someone controls your email, they can typically reset the password on nearly everything else. Prioritise a unique, strong password and 2FA on your email above all other accounts.