Key Takeaways
- Complexity alone doesn't make a password strong — length and unpredictability matter far more.
- Reusing passwords across sites is one of the most dangerous habits in digital security.
- Mandatory frequent password changes can backfire by encouraging weaker, predictable choices.
- A password manager is a safer and more practical solution than relying on memory.
- Two-factor authentication adds critical protection that a strong password alone cannot provide.
Why Password Myths Are a Real Security Problem
Most people believe they're following solid password advice. The problem is that much of the conventional wisdom passed down over the years — from IT help desks, pop-up warnings, and well-meaning friends — is either outdated, oversimplified, or just plain wrong. These myths persist because they feel logical, even when the evidence points the other way.
Understanding what actually makes a password secure — and what doesn't — is the first step toward protecting your accounts. For a full grounding in the topic, see our complete guide to password safety. The myths below are among the most widely believed and the most damaging.
Myth
Adding a number or symbol to the end of a word makes a password secure.
Fact
Predictable substitutions like "Password1!" are among the first patterns automated cracking tools test.
Attackers use tools that automatically apply common substitution rules — swapping "a" for "@", appending "123", or capitalizing the first letter. A short word with a tacked-on symbol offers very little real protection. What genuinely resists cracking is length and randomness. A passphrase of four or more unrelated words (e.g., "jacket-river-cube-Monday") is both easier to remember and exponentially harder to crack than a short, symbol-sprinkled word.
Myth
You should change your password every 30 or 90 days to stay secure.
Fact
Forced frequent changes often lead to weaker passwords, not stronger ones — security guidance has shifted away from this practice.
When people are required to change passwords constantly, they tend to make minimal tweaks: "Spring2024" becomes "Summer2024." The U.S. National Institute of Standards and Technology (NIST) updated its guidelines to recommend changing passwords only when there is evidence of compromise, rather than on a fixed schedule. Regular changes are worth doing after a known breach or if you suspect an account has been accessed — not simply because a calendar reminder says so.
Myth
Using the same strong password across multiple sites is fine as long as the password itself is hard to crack.
Fact
Credential stuffing attacks exploit reused passwords — one breached site can expose every account that shares the same credentials.
Even a genuinely strong password becomes a liability the moment it's reused. When a service is breached, attackers sell or publish the leaked credentials. Automated tools then try those exact username-and-password combinations across hundreds of other sites — a technique called credential stuffing. A unique password for every account means a single breach stays contained. See how attackers actually steal passwords for a closer look at this method.
Myth
A strong password is all the protection your account needs.
Fact
Passwords can be stolen through phishing or data breaches regardless of their strength; a second factor of authentication closes that gap.
No password, however complex, protects against phishing — a technique where you're tricked into entering your credentials on a fake site. Nor does it help if the service itself is breached and stores passwords poorly. Two-factor authentication (2FA) means an attacker who obtains your password still can't log in without a second verification step, such as a code sent to your phone or generated by an authenticator app. Strength and uniqueness matter, but they are not a complete defense on their own.
Myth
Writing passwords down is always dangerous and should never be done.
Fact
A physically secured written record is safer than a weak, reused, or forgotten password — context determines the risk.
The real risk with written passwords is exposure: a sticky note on a monitor, a notebook left on a desk at work, or a note in an unlocked phone. A written list stored in a locked drawer at home, or in a fireproof document safe, is significantly less likely to be exploited than a password that's been reused across a dozen sites. That said, a reputable password manager is a more practical and scalable solution for most people, eliminating the physical risk entirely.
Myth
Longer passwords are always too hard to remember, so shorter ones are a necessary trade-off.
Fact
Passphrases — strings of several random words — are both long and memorable, making the trade-off largely unnecessary.
The assumption that security and memorability are opposites is one of the most limiting password myths. A phrase like "correct-horse-battery-staple" is 28 characters long, resistant to brute-force attacks, and far easier to recall than "C0rr3ct!8". For accounts where you can't use a password manager, a passphrase strategy gives you strong security without the cognitive burden of remembering a string of random characters.
Building Better Habits After Busting the Myths
Correcting your mental model about passwords is only useful if it leads to concrete changes. The single most impactful shift most people can make is to stop relying on memory altogether. Relying on memory encourages predictable patterns and reuse — the two habits attackers count on most.
Don't Wait for a Breach to Act
Many people only reconsider their password habits after an account is compromised. By that point, damage — including unauthorized purchases, identity theft, or account lockout — may already have occurred. Auditing your passwords now, before a breach happens, costs far less time and stress than recovering afterward. Check whether any of your credentials have appeared in known data breaches using a reputable breach-notification service.
A password manager generates and stores long, unique credentials for every account, removing the temptation to recycle or simplify. Pair that with two-factor authentication (2FA), which adds a second verification step that a stolen password alone can't bypass. Learn more about how two-factor authentication protects your accounts and how passwords and 2FA work together.
Finally, password hygiene doesn't exist in isolation. The same careful thinking applies to your network and devices — explore device security myths and network security myths to close other common gaps. For ongoing, evidence-based practices, see proven habits that keep your passwords working in your favour.
81%
Of breaches involving compromised credentials
According to Verizon's Data Breach Investigations Report, the majority of hacking-related breaches exploit stolen or weak passwords.
2–3 seconds
Time to crack an 8-character password
Security researchers estimate that modern hardware can crack a simple 8-character password in a matter of seconds using brute-force techniques.