30/07/2026
The old rules about strong passwords are out of date.
For years the standard advice was eight characters, mix uppercase and lowercase, throw in a number and a symbol. NIST, CISA, and Microsoft's own identity team all moved off that advice years ago. The current recommendation is simpler and stronger. Use long passwords or passphrases, and stop forcing your team to rotate them on a schedule.
The math is straightforward. Modern password-cracking hardware can guess a complex 8-character password in less than an hour. A 16-character passphrase made of common words takes centuries against the same hardware. Length wins because every extra character multiplies the work an attacker has to do, while complexity adds only modest barriers.
The policy update for your business is short. Set a minimum of 14 characters for general accounts and 16 or more for admin or sensitive ones. Mandatory rotation creates more weak passwords than it prevents, so stop forcing it. Required complexity rules tend to push people toward simpler, less secure patterns, so drop those too. Block any password that appears in known breach databases, and require MFA on every account that supports it.
If your business is still using 8-character passwords with quarterly rotation, you're following the rules from 2010. The new rules are easier on your team and harder on attackers.
