Password security without the hassle

The classic password rule ("at least one special character, one number, one capital letter, change every 90 days") is now widely considered outdated by security experts. It mostly leads people to pick predictable patterns ("Summer2024!" becomes "Summer2025!") or write passwords down. A few rules that actually improve security in practice, without complicating daily life:

Length beats complexity

A long, memorable phrase ("CoffeeMakesMondaysBearable!") is much harder for attackers to crack than a short, cryptic password full of special characters — and it's still easy to keep in your head.

A separate password for every service

The single biggest risk factor is reuse: if a password leaks from a hacked third-party service, attackers automatically try it across dozens of other services. A password manager (there are good free options) takes the burden off remembering a unique, long password for every service — you only need to remember the one master password.

Two-factor authentication wherever possible

An additional code from an app (avoid SMS where possible) makes a stolen password mostly worthless to attackers. For email accounts and anything with access to finances or customer data, this is one of the single most effective measures available — and takes just a few minutes to activate in most services.

Avoid shared logins

A shared login the whole team uses is convenient, but a problem in practice: nobody knows anymore who accessed what and when, and when someone leaves the team, the password has to be changed for everyone. Individual accounts per person are the cleaner path, even if setup takes a bit more effort upfront.

A password manager plus two-factor authentication protects against the vast majority of everyday attacks — that's often all the effort it really takes.