For years, the password advice went something like this. Make it at least eight characters. Include a capital letter, a number, and a symbol. Change it every ninety days. Never write it down.
If you followed this advice diligently, you probably ended up with a password like "Summer2024!" that you changed to "Autumn2024!" in October, then "Winter2025!" in January, carefully cycling through the seasons like a particularly security-conscious calendar. And you were, technically, following the rules.
You were also, unfortunately, not very secure. Because criminals already knew about this pattern and had programmed it into their guessing tools.
Why the old rules were counterproductive
The complexity rules were introduced with good intentions. The idea was that making passwords harder to type would make them harder to guess. What nobody fully anticipated was human nature.
When people are forced to make passwords complex, they do not create genuinely random combinations. They create predictable ones. They capitalise the first letter. They put the number at the end. They substitute letters with symbols in entirely predictable ways — the letter "a" becomes "@", the letter "e" becomes "3", the letter "s" becomes "$". Security researchers call this leet speak and it has been in every password cracking tool since the early 2000s.
The mandatory change policy was even more counterproductive. When people are told to change their password every ninety days, they make the smallest possible change. They add a 1 at the end. They change Summer to Autumn. They increment a number. Attackers know this too. A tool trying to crack a changed password will always try the obvious variations of known previous passwords first.
This is not a new discovery. NIST — the US body that sets the global standard for digital security guidance — explicitly abandoned complexity rules and mandatory change requirements in 2017, and updated its guidance again in 2025 to be even clearer. Change passwords when there is a specific reason — a known breach, a suspicion of compromise — not on a calendar schedule. Choose length over complexity. Allow passphrases.
What actually makes a strong password
Length is the single most important factor. An eight-character password, even a complex one, can now be cracked in a matter of hours with modern hardware. A sixteen-character password of seemingly random lowercase letters takes centuries. This is not a matter of opinion — it is the mathematics of how password cracking works.
The NCSC's current recommendation, which they have held since 2016 and which remains the clearest consumer advice in the UK, is three random words. Pick three words that have no logical connection to each other or to you, and join them together. "PurpleKettleMonday" is not elegant. It is not particularly memorable. But it is eighteen characters long, contains no predictable patterns, and is vastly stronger than "P@ssw0rd1!" which a modern cracking tool will guess in under a second.
Adding a number and a symbol somewhere in a three-word passphrase makes it stronger still without making it significantly harder to remember. "Purple3KettleMonday!" is excellent.
What to avoid, specifically: your name, your children's names, your pet's name, your sports team, your birthday or anniversary, any word from the dictionary used alone, and the name of the website or service the password is for. All of these are in the attack lists. All of them will be tried within the first few thousand guesses.
The Premier League problem
The NCSC, in a moment of delightful specificity, once published data showing that football team names were among the most commonly used passwords in UK data breaches. Every Premier League team appeared in the data. Chelsea, Arsenal, Liverpool — all of them, used by real people to protect real accounts.
If your password contains the name of a football team, a musician you love, a TV show you watch, or a film you have seen recently, the same logic applies: it is in the list that attackers try first. Your passion for Oasis or your loyalty to Manchester United is not a secret. It is on your social media profile.
The one rule that overrides everything else
A strong password on one account is infinitely better than a strong password used on many. Unique beats complex, every time.
Verizon's 2025 research found that credential stuffing — using passwords stolen from one site to access accounts on others — is the single most common initial access method in data breaches, accounting for 22% of all investigated cases. This is not hackers cracking your individual password. It is automated systems trying millions of stolen combinations until one works.
A sixteen-character passphrase used on twenty accounts is dramatically less safe than a different eight-character password on each one. The moment any of those twenty sites suffers a breach, every account that shares the password is exposed.
What does this mean for me?
Length over complexity. Aim for at least fifteen characters. Three random words with a number and symbol gives you this easily.
Different password for every account. This is the most important rule. It is also, admittedly, humanly impossible to achieve without help — which is where next Tuesday's article comes in.
Check the NCSC's own advice at ncsc.gov.uk/collection/top-tips-for-staying-secure-online — it is plain English, up to date, and free.
Stop changing passwords on a schedule. Change them when there is a reason — a breach notification, a suspicious login, or the suspicion that someone else knows it. Not because ninety days have passed.
The book connection: In C is for Cyber, C is for Chameleon and Cryptography — the science of making messages unreadable to everyone except the intended recipient. A strong password is the human end of cryptography: the thing that proves to the system that you are you.
🧠 The Human Factor
| Technology involved | Password cracking tools, credential stuffing automation, and the gap between what complexity rules were designed to achieve and what they actually produce in human behaviour |
| Root cause | Security advice designed around ideal behaviour rather than actual human behaviour — producing predictable workarounds that attackers had already programmed into their tools |
| What was at risk | Every account protected by a password that follows the old, predictable complexity patterns — capitalised first letter, number at the end, seasonal change cycles |
| Prevention | Length over complexity; three random words with a number and symbol; unique passwords for every account; change passwords when there is a reason, not a schedule |
References and sources
- NCSC: Password guidance and three random words — ncsc.gov.uk
- NIST Special Publication 800-63 (2025 revision) — nist.gov
- Verizon DBIR 2025 — verizon.com
- Hive Systems Password Table 2025 — hivesystems.io
- NCSC: Most hacked passwords revealed — ncsc.gov.uk