Passwords and password managers: what actually works

Password advice has changed. Forget forced monthly changes and "P@ssw0rd!". Here's what the NCSC recommends now.

The NCSC's advice in brief

• Use three random words for passwords you need to remember, for example cobalt ferry window. Length beats complexity.
• Avoid personal details such as names, birthdays, pets and football teams. They're easy to find on social media.
• Never reuse a password across accounts. When one site is breached, criminals try the same password everywhere.
• Use a password manager to create and store unique passwords for everything else.
• Use passkeys where a service offers them. They can't be phished or reused.
• Turn on multi-factor login wherever you can.

Why forced password changes are out

Making staff change passwords every 90 days just leads to Password1, Password2, Password3. The NCSC advises against routine forced changes. Change a password when there's a reason, such as a breach, a phishing click or someone leaving.

Password managers for a small business

A password manager means each person only remembers one strong passphrase. It fills in unique passwords for every other account. Business versions add shared vaults, so the team can share logins safely instead of using spreadsheets or sticky notes, and admin controls to remove access when someone leaves. Several well-known products offer free or low-cost plans.

Quick checklist

1. Change all default passwords on routers, printers, cameras and new software.
2. Give every person their own login. No shared "office" accounts.
3. Set up a password manager, with a strong passphrase and MFA protecting the vault itself.
4. Turn on MFA for email, banking and admin accounts first.
5. Remove access the day someone leaves.

How this connects to Cyber Essentials

Cyber Essentials expects default passwords to be changed, every user to have their own account, accounts to be protected with strong passwords, and multi-factor login on cloud services. A password manager plus MFA covers most of it.