10 Password Myths That Refuse to Die

Password advice has a fossil-record problem. Rules minted for 1990s office networks - Human attackers, no GPUs, no breach corpora - Got baked into corporate policy, school curricula, and family lore, then outlived the world that justified them. Security researchers have since measured what actually predicts compromise, and standards bodies rewrote their guidance accordingly; NIST's SP 800-63B reversed several of its own earlier positions. Yet the folklore persists, and some of it now actively makes people less safe. Here are ten myths, each held up against current evidence.

Myths about what makes passwords strong

Myth 1: Symbols and mixed case are what make a password strong. Strength comes from unpredictability × length, and character variety is a minor multiplier: the entire symbol set adds about 0.6 bits per character over letters-and-digits, while each added character contributes ~6. Worse, humans deploy symbols in statistically canned ways (! at the end, @ for a) that cracking rules absorb for pennies. Sunshine2026! passes every complexity check and falls in seconds; sixteen random characters with no symbol at all outlasts civilization.

Myth 2: My clever personal system beats a generator. Substitution schemes, initials-of-a-sentence, sitename-woven-into-a-base - Every scheme a human can invent and remember is a pattern, and patterns are what rule-based cracking industrializes. Attackers train on billions of leaked passwords; your system has statistical siblings in that corpus. Randomness is the only property rules can't compress, which is the case made in random vs memorable passwords.

Myth 3: A password no one could guess about me is safe. Guessing isn't personal anymore. Nobody ponders your dog's name; software tries hundreds of billions of candidates derived from breach data. "Obscure to my acquaintances" and "absent from cracking wordlists" are unrelated properties - qeadzcwrsfxv1331 looks like keyboard chaos and appears in real breach corpora. Only the generation process (dice, not brain) determines safety, and a password strength checker that models real attack patterns will show the difference brutally.

Myth 4: Password tests and meters flatter me, so I'm fine. Naive meters count character classes; attackers count patterns. A meter that scores P@ssw0rd1! as "strong" is measuring compliance, not resistance. Trust estimators that model dictionaries and mangling rules - And distrust any site whose meter is the only thing standing between you and an 8-character minimum.

Myths about managing passwords

Myth 5: You should change your passwords every 90 days. The marquee reversal. Mandatory rotation, studied at scale, produced predictable transformations - Winter2025! → Spring2026! - That attackers model trivially, while burning user patience and driving passwords onto sticky notes. NIST SP 800-63B now recommends against scheduled expiration: change a password when there's evidence of compromise, not on a calendar. The full story of the policy U-turn is in how often you should change your password.

Myth 6: Writing passwords down is always terrible. The threat is a botnet in another hemisphere, not a burglar reading your notebook. A written master password stored like cash - Wallet, locked drawer, safe - Is a defensible practice, and for many households (elderly relatives especially) beats the alternative of one weak password reused everywhere. The sin was never paper; it was the monitor-mounted sticky note in a shared office. Digital equivalents belong encrypted, never in a plain notes app.

Myth 7: Password managers are a dangerous single point of failure. A real trade-off, honestly won by the manager. The realistic alternative isn't 150 memorized random strings - It's reuse, and reuse converts any one site's breach into a master key via credential stuffing. A zero-knowledge manager encrypts everything under a key derived from your master password, so even a breach of the manager's servers yields ciphertext the vendor itself can't open. Weigh it properly in the password manager guide - And note the browser's built-in storage is a related but different trade-off.

Myth 8: I have nothing worth stealing. Criminal interest is automated and indiscriminate: accounts are commodities. A streaming login retails for a dollar or two; an email account is a skeleton key for resetting everything else; a clean social profile is a scam-distribution asset; your computer is rentable botnet capacity. The Verizon DBIR consistently ranks stolen credentials among the top breach vectors - Harvested in bulk, not curated by victim importance.

Myths about the attack itself

Myth 9: Hackers guess passwords by trying the login form a lot. The mental image of someone hammering your login page is mostly wrong - Rate limits make that a trickle. The industrial version is offline: steal a database of password hashes, then guess at billions per second on private hardware, where the site's lockout policy can't see or stop anything. This is why entropy matters so much more than login throttling - And why precomputation tricks and their defeat, told in rainbow tables explained, reshaped how sites store passwords.

Myth 10: 2FA means my password barely matters. Two-factor authentication is the single best upgrade available - And a second factor, not a replacement first one. SMS codes fall to SIM swaps, push prompts to fatigue attacks, and any 2FA to a real-time phishing proxy; meanwhile a weak password still exposes you wherever that 2FA isn't enforced, including some API and legacy-login paths. Run app-based codes from an authenticator app on top of a generated password, and the layers cover each other's failure modes.

Almost every myth here shares one broken assumption: that the attacker is a person. The attacker is a pipeline - Wordlists, rules, GPUs, and breach data - And advice built for humans guessing loses to machinery every time.

The scorecard

FAQ

If rotation is out, when should I actually change a password?

On evidence, immediately: the service announces a breach, the password appears in a monitoring alert (haveibeenpwned.com), you entered it on a page you now distrust, you shared it, or a device that stored it was lost or infected. Also retire any password that predates your generator era - Not because it aged, but because it was probably weak at birth.

Is the four-random-words advice (correct-horse style) still valid?

Yes, in its niche: passwords a human must memorize, like a master password - With the crucial caveat that the words come from a random generator or dice, not your own head, and six words is today's more comfortable margin than four. For everything autofilled by a manager, random character strings remain the denser, better choice.

My workplace still enforces 90-day changes and symbol rules. Are they wrong?

They're behind, which isn't quite the same thing - Policy frameworks, auditors, and legacy systems move slowly, and some compliance regimes still mandate the old rules. Comply, obviously; a generator makes compliance painless and immune to the Season+Year trap. If you have influence, point the policy owners at NIST SP 800-63B, which now explicitly discourages both practices.

Are passkeys about to make all of this obsolete?

Directionally yes, eventually. Passkeys replace the shared secret entirely with device-bound cryptography, immune to phishing, reuse, and database theft. But rollout is uneven, fallback passwords guard most passkey-enabled accounts anyway, and millions of legacy systems will demand passwords for years. Password hygiene remains load-bearing through a long transition.

What's the single highest-impact fix if I only do one thing?

Uniqueness - Eliminating reuse - Because it converts breaches from cascading disasters into contained ones. In practice that means adopting a manager and letting it generate as you go; start with email and banking, since those unlock everything else. Strength without uniqueness still loses to credential stuffing; uniqueness without perfect strength usually survives it.