Password security in 2026: what actually matters now

What changed

Passkeys crossed a real adoption threshold: most major platforms and a growing share of everyday sites now support them, and where they're available they're both more secure and more convenient than a password, because they're resistant to phishing by design — there's no secret string to trick someone into typing into a fake login page. Where a passkey option exists, use it. That's the single biggest shift from five years ago.

What didn't change

For every site that doesn't yet support passkeys — and that's still most of them — the old fundamentals still hold: length beats complexity, reuse is still the single biggest risk factor in real breaches, and a password manager is still the only realistic way to have a unique password for every account without losing your mind.

The habit worth keeping: length over cleverness

A sixteen-character passphrase built from four unrelated words takes vastly longer to brute-force than an eight-character password stuffed with symbols, and it's easier to type and remember. "correct horse battery staple"-style phrases were mocked for years as too simple, but the math on entropy per character has always favored length.

The habit worth keeping: unique passwords, enforced by a tool, not memory

Nobody genuinely remembers forty unique sixteen-character passwords, and that's fine — that's what a password manager exists to solve. The moment you rely on memory for more than two or three passwords, you'll unconsciously reuse patterns, and pattern-based reuse is exactly what credential-stuffing attacks exploit after any single breach.

The habit worth keeping: two-factor authentication, but the right kind

SMS-based two-factor is better than nothing but is still vulnerable to SIM-swapping attacks. An authenticator app or, better, a hardware security key removes that specific risk. If a site offers a choice, pick the app or key over SMS.

A breach I helped a friend recover from

A friend reused one memorable password across a shopping site, a forum, and her email. The shopping site got breached in a batch of 40 million records posted publicly a year later; within days her email had a login attempt from an unfamiliar country, caught only because her email provider flagged it. Rotating that one password everywhere it had been reused, and turning on an authenticator app for email specifically, took about twenty minutes and would have taken zero minutes of cleanup if a password manager had generated a unique password for each site from the start.

What a password manager's audit feature actually catches

Most modern password managers include a built-in security check that flags reused passwords, weak passwords, and accounts caught in known breaches. Running that check for the first time on an account with fifteen years of accumulated logins routinely surfaces ten or more reused passwords nobody remembered creating a five-minute scan that would otherwise require checking every site by hand.

The habit you can drop: mandatory 90-day password rotation

Forced periodic password changes were shown years ago to make security worse in practice, because people respond by making small predictable variations (Password1, Password2) rather than genuinely new passwords. Most major security guidance bodies dropped this recommendation, and if your organization still enforces it, that's worth raising with IT.

The habit you can drop: worrying about quantum computers breaking your passwords today

Quantum-resistant cryptography is a real and active area of standards work, but it targets specific asymmetric algorithms used in things like TLS key exchange, not the hashing schemes protecting your everyday password. This isn't something an individual user needs to act on personally in 2026.

A five-minute checkup worth doing this week

Check whether your most important accounts (email, bank, primary cloud storage) support passkeys and switch if they do; confirm your password manager is actually generating unique long passwords rather than autofilling old reused ones; and check your email address against a breach-monitoring service to see if any of your existing passwords are already circulating.

The specific breach math that makes reuse so dangerous

Credential-stuffing tools can attempt millions of leaked username-and-password combinations against a new target site within hours of a breach dump going public, entirely automated. A password reused across even three sites means one leak effectively hands attackers the keys to all three, and they don't need to guess anything — they're just replaying a combination that already worked somewhere else. This is precisely why length and complexity of a reused password barely matter once it's been exposed in a breach; the fix is uniqueness, not strength.

Recovery codes: the backup most people forget about

Every account with two-factor authentication enabled generates one-time recovery codes at setup, usually shown once and easy to dismiss. Losing your authenticator app or security key without saving those codes somewhere durable — printed, or stored in your password manager's secure notes — can lock you out of your own account for days while support verifies your identity manually. Saving recovery codes takes thirty seconds at setup and has saved me personally on two separate occasions after a phone reset wiped an authenticator app's data.

Straight answers

Are passkeys actually safe, or is that overhyped? They're genuinely more phishing-resistant than passwords because there's no secret to steal via a fake login page — the cryptographic proof is tied to the real site's domain.

Do I still need a password manager if I switch to passkeys everywhere? Yes, for the foreseeable future, since most sites still only support passwords and you'll need somewhere to store those securely too.

Is it still bad to write passwords on paper? It's far better than reuse, but a password manager with a strong master password is both more convenient and harder to lose than a notebook.

What's the most common way passwords actually get compromised today? Reuse across sites combined with a breach at one of those sites, followed by phishing — brute-force guessing of a single strong password is comparatively rare.

Should I use my browser's built-in password manager or a dedicated app? Either is far better than reuse; a dedicated password manager usually wins on cross-browser support and more thorough breach-monitoring features, but a built-in manager is a perfectly reasonable starting point.