Credential Hygiene: Passwords, Passkeys and MFA That Hold Up

Strong credential hygiene in 2026 comes down to four habits. Use a long, unique password for every account, generated and stored by a password manager. Turn on the strongest second factor each account offers, preferring passkeys or security keys over codes. Keep recovery options current so a lost phone is an inconvenience, not a lockout.

The rules most people learned at work are out of date. Current US federal guidance, NIST SP 800-63B revision 4, tells services to stop forcing symbol-and-number mixes and stop forcing scheduled password changes. It tells them to require length and to screen new passwords against breach lists. Your habits should follow the same logic: length and uniqueness beat cleverness, and phishing resistance beats any code you can type.

This guide is the user-habits course. It does not repeat why passwords are structurally weak (that is Why Passwords Fail), why text-message codes fall short (SMS MFA is not MFA), or how developers build passkey login (Implement Passkeys with WebAuthn). It covers what to do, at work and at home.

What current password guidance actually says

NIST finalised SP 800-63B revision 4 in July 2025, replacing the 2017 rules most corporate policies were built on. It is written for the services that check your password, but it doubles as a list of habits:

• Length is the requirement. A password used on its own must be at least 15 characters. A password used only as part of multi-factor sign-in may be as short as eight. Services should accept at least 64 characters.
• No composition rules. Services "SHALL NOT impose other composition rules", which means no forced mix of uppercase, digits and symbols.
• No scheduled rotation. Services "SHALL NOT require subscribers to change passwords periodically". A change is forced only when there is evidence of compromise.
• Breach screening. New passwords must be compared against a blocklist that includes passwords from previous breach corpuses, plus common and expected choices.
• Password managers must work. Services "SHALL allow the use of password managers and autofill" and should permit paste.
• No hints, no security questions. Services may not store a hint anyone can read, and may not prompt you to set knowledge-based questions.

The same document says plainly that "passwords are not phishing-resistant". It also restricts phone-network delivery (SMS or voice) for one-time codes and bans email for out-of-band authentication.

Why did the rules change? Composition rules produce predictable patterns like Summer2026!, which attackers already try first. Forced rotation produces Summer2026! followed by Autumn2026!. Neither adds real strength.

Common mistakes

• Treating a complex 8-character password as strong. Length matters far more than symbols.
• Changing every password on a calendar schedule while reusing the same base word. Change on evidence of compromise instead.
• Answering security questions truthfully. Your mother's maiden name and first school are often public. If a site forces questions, store random answers in your password manager.

Action checklist

• Stop rotating personal passwords on a schedule; change one only when there is a reason
• Make every password you create at least 15 characters long
• Replace any truthful security-question answers with random strings stored in your password manager
• If you run awareness training, update slides that still teach symbol rules or 90-day rotation

Passphrases: how long is long enough

You need to memorise only a handful of secrets. Everything else should be generated by a password manager and never typed by hand. The secrets you memorise are your device passcode, your password manager's master password, and possibly your primary email and work sign-in.

For those, use a passphrase made of random words. The UK National Cyber Security Centre recommends three random words as a password that is "long enough and strong enough" for most purposes while staying easy to remember. For the master password that protects every other secret, go further. The EFF dice-generated passphrase method suggests "a six-word passphrase" for most applications, which gives about 2^77 possible combinations from its word list.

The randomness is what matters. Words you picked because they mean something to you (a pet, a team, a lyric) are not random. Attackers build guessing lists from exactly those sources. Use dice, your password manager's passphrase generator, or a tool such as the AI password generator, then keep the result.

How long is long enough, in practice:

Common mistakes

• Adding a number and symbol to a famous quote. Quotes and song lyrics are in cracking dictionaries.
• Reusing your master password anywhere else. A breach elsewhere then unlocks your vault.
• Writing the master password in a notes app on the same phone. A paper copy in a safe place at home is better.

Action checklist

• Generate a six-word random passphrase for your password manager master password
• Practise typing it daily for two weeks until it sticks
• Store a paper copy somewhere physically secure at home, never in a cloud note
• Confirm your device passcode is at least six digits

Password managers: choosing, migrating and securing the vault

A password manager is the only practical way to have a unique password for every account. NIST now requires services to allow them for this reason. The manager also adds a quiet phishing defence: autofill matches the saved site address, so it will not offer your bank password on a lookalike domain. If autofill stays blank on a page that looks right, stop and check the address.

How to choose

Compare products on these criteria rather than marketing claims. For side-by-side options, see the comparison of password managers.

• End-to-end encryption. The provider should be unable to read your vault.
• Passkey support. It should store and sync passkeys, not just passwords.
• Platform coverage. Every device and browser you use, including your phone.
• Breach and reuse alerts. It should flag reused, weak and exposed passwords.
• Secure sharing. Shared vaults or items for family or team members, with revocation.
• Emergency or recovery access. A documented way back in if you forget the master password.
• Export. You should be able to leave with your data.

How to migrate without losing anything

1. Install the manager on your main computer and phone.
2. Import passwords saved in your browsers, then turn off the browser's own password saving so new logins go to one place.
3. Delete the old browser copies once the import is verified, so stale passwords do not linger.
4. Run the manager's reuse and weakness report. Change the reused ones first, starting with email, banking and work.
5. Work through the rest over a few weeks, a handful per day, as you naturally sign in.

Securing the vault itself

Your vault is now the single most valuable thing an attacker can target. Protect it with the long passphrase from the previous module plus the strongest second factor the manager supports. A security key or passkey is best. Lock the vault automatically after a short idle period. Keep the manager's apps updated.

Sharing, and keeping work and home separate

Never send a password over email, chat or text. Use the manager's sharing feature, which lets you revoke access later. Keep work and personal credentials in separate vaults. If your employer provides a business manager, put work credentials there and nothing personal: you lose that account when you leave.

Action checklist

• Pick a password manager using the criteria above and install it on every device you use
• Import browser-saved passwords, then turn off browser password saving
• Protect the vault with a passphrase and the strongest MFA it offers
• Fix every reused password on email, banking and work accounts this week
• Move any shared family passwords into a shared vault instead of messages
• Keep work credentials in the work vault and personal ones in your personal vault

Breach checking: find out what is already exposed

Your passwords may already be in a criminal's list, through no fault of yours. A breach at any site you used years ago exposes that password everywhere you reused it. Checking is quick and does not require trusting anyone with your password.

Have I Been Pwned offers two checks. The email search tells you which known breaches included your address. The Pwned Passwords range API checks a password without sending it. Your device hashes the password with SHA-1 and sends only the first five characters of the hash. The service returns every hash suffix that shares that prefix, and your device looks for a match locally. This is called k-anonymity: the service never learns which password you checked. Many password managers run this check for you inside their breach report.

What to do when something shows up

1. Change that password everywhere you used it, not only on the breached site. Use a new, generated one for each.
2. Turn on MFA on each affected account if it was off.
3. Sign out of other sessions from the account's security page, so a stolen session stops working.
4. Check recovery settings (recovery email, phone, forwarding rules). Attackers often add their own.
5. Watch for targeted phishing. A breach that leaked your name, employer or phone number makes convincing follow-up messages easier to write.

The full playbook, including financial steps, is in Was your password in a data leak? What to do next.

Common mistakes

• Typing your password into a random "have I been hacked" site. Use HIBP or your password manager's built-in check.
• Changing only the breached site's password and leaving the same password elsewhere.

Action checklist

• Search your personal and work email addresses on Have I Been Pwned
• Subscribe to breach notifications for your addresses
• Run your password manager's exposed-password report and fix every hit
• For each exposed account, sign out other sessions and review recovery settings

MFA ranked by phishing resistance

Any second factor is a large improvement over a password alone. A Microsoft Research study of Azure Active Directory accounts estimated that MFA reduced the risk of compromise by 99.22% across the population studied, and by 98.56% where credentials had leaked. The same paper found dedicated authenticator apps outperformed SMS.

Not all factors are equal against a phishing page, though. CISA's fact sheet on implementing phishing-resistant MFA ranks methods from strongest to weakest. FIDO/WebAuthn and PKI-based methods are at the top as "the gold standard". App-based codes and push with number matching come next, then push without number matching, then SMS or voice as a last resort. CISA's summary is that any MFA beats none, but moving to phishing-resistant MFA should be a high priority.

The difference at the top is structural. A passkey or FIDO2 security key signs a challenge tied to the real site's address, so a lookalike domain gets nothing useful. A six-digit code works wherever you type it. The SMS weaknesses are covered in SMS MFA is not MFA, and SIM swap specifically in the Scam Atlas SIM swap entry.

MFA fatigue and push bombing

Push bombing means flooding you with approval prompts until you accept one to make them stop. CISA lists it as a named threat to MFA. It is not theoretical. In Uber's September 2022 security update, the company said an attacker likely bought a contractor's corporate password on the dark web. The contractor received repeated login approval requests and "eventually" accepted one.

Number matching blunts this. Microsoft Authenticator now shows a number on the sign-in screen that you must type into the app, and users cannot opt out. You cannot satisfy a prompt you did not start, because you do not have the number.

The habits that go with it:

• Never approve a prompt you did not trigger, even once, even to make it stop.
• Report unexpected prompts immediately. A prompt means someone already has your password.
• Distrust a "helpdesk" call that follows a prompt flood. Attackers often phone pretending to be IT and ask you to accept. See the Scam Atlas MFA fatigue entry and helpdesk reset impersonation.

More on how attackers get around weaker factors is in Minimizing credential theft with MFA. For organisations choosing a platform, see the passwordless MFA platform comparison.

Action checklist

• Turn on MFA for email, banking, password manager, cloud storage and social accounts
• Wherever a site offers a passkey or security key, use it instead of SMS
• Move remaining SMS-only accounts to an authenticator app where the site allows
• Commit to never approving a push prompt you did not start
• Report any unexpected MFA prompt to IT or, at home, change that account's password now

Passkeys for everyday users

A passkey replaces the password with a key pair. The private half stays on your device or in your password manager; the site stores only the public half. You unlock it with your fingerprint, face or device PIN. Google's help page notes that your biometric data stays on your device and is never shared with Google. Because the passkey only works on the site that created it, it cannot be handed to a phishing page.

They are also easier. In Google's March to April 2023 data, same-device passkey sign-ins succeeded 63.8% of the time against 13.8% for passwords. Passkey sign-ins averaged 14.9 seconds against 30.4 for passwords.

Synced versus device-bound

The FIDO Alliance describes two kinds of passkey.

• Synced passkeys live in a passkey provider (Apple, Google, or a password manager) and follow you to new devices.
• Device-bound passkeys stay on one piece of hardware, typically a security key, and never leave it.

FIDO notes phishing resistance holds at sign-in "whether or not the cryptographic keys are bound to hardware".

For most people, synced passkeys are the right default. Device-bound keys suit high-risk roles such as administrators, finance staff and journalists, and anyone who wants their most important accounts tied to hardware. NIST's revision 4 explicitly added support for syncable authenticators like synced passkeys.

What happens if you lose your phone

With synced passkeys, setting up a new device with the same provider brings your passkeys back. Apple's passkey security page explains that iCloud Keychain is end-to-end encrypted with keys Apple does not know. If you lose every Apple device, recovery requires your Apple Account password, an SMS to your registered number, and a previous device passcode. Apple also lets you set an account recovery contact.

On a Google Account, sign in from any device you still have and remove the passkey from the lost one under Security & sign-in, per Google's passkey help.

The real risk is a single device-bound key with no backup. Register two security keys for any account protected that way, and keep one at home. Passkeys have attack paths of their own, mostly around syncing and recovery; see Pass-the-passkey attacks. For a broader comparison with passwords, read Passkeys vs passwords.

Common mistakes

• Creating a passkey but leaving SMS as an easy fallback. The account is only as strong as its weakest sign-in path.
• Registering one hardware key and no second method.

Action checklist

• Create passkeys for your primary email, Apple or Google account, and password manager
• Decide on one passkey provider and save new passkeys there
• If you use hardware security keys, register at least two per account
• Set up an account recovery contact or equivalent with your platform provider
• After adding a passkey, remove SMS as a sign-in method where the site allows

Recovery codes and account recovery hygiene

Attackers often skip your strong sign-in and attack the recovery path instead: the reset email, the backup phone number, the support desk. Good recovery hygiene means you can get back in, and an attacker cannot.

Recovery codes are the simplest backstop. Google's backup codes come in sets of 10. Each code works once, and generating a new set deactivates the old one. Most major services offer something similar.

How to handle them:

• Generate them when you enable MFA, not after you need them.
• Store them offline or in your password manager, separately from the device you use to sign in. A printout in a home safe or locked drawer works.
• Regenerate after use. Once you burn a few codes, generate a fresh set so the count stays useful.
• Review recovery details twice a year. Remove old phone numbers and old email addresses you no longer control.

Your email account deserves extra care. The UK NCSC warns that a criminal inside your email can reset your other account passwords. Treat email as the master key it is.

If the worst happens, use only official recovery paths. The Locked Out guides walk through recovery step by step for Google, Microsoft and Apple. The recovery kit lists what to prepare in advance. Beware of anyone offering to recover your account for a fee: recovery scams target exactly the moment you are locked out.

Action checklist

• Generate and store recovery codes for email, password manager and cloud accounts
• Remove old phone numbers and email addresses from every account's recovery settings
• Check your email for forwarding rules or filters you did not create
• Prepare the Locked Out recovery kit before you need it
• Put a twice-yearly recovery review in your calendar

Credential habits at work

At work, your credentials protect more than you. The Verizon Data Breach Investigations Report continues to name stolen credentials, phishing and social engineering among the most frequent causes of breaches. One reused password can become the entry point for the whole company.

The habits that matter most:

• Never reuse a work password anywhere else. Not on a personal account, not on a conference site, not on a SaaS trial. A breach at the other site becomes a breach at your employer.
• Use single sign-on when it is offered. SSO means one well-protected identity instead of dozens of separate passwords. If a tool offers "Sign in with" your company account, prefer it over a separate login.
• Never share credentials, even with a colleague. Ask for proper access instead. Shared accounts make it impossible to see who did what.
• Treat unsolicited reset calls as suspicious. IT will not ask for your password or an MFA code. Hang up and call the helpdesk on a number you already have.

Reporting suspected compromise

Report fast, and report without fear. You should report if you typed credentials into a page that felt wrong, approved a prompt you did not start, or saw an unexpected MFA prompt or login alert. Early reports let security revoke sessions and reset access before damage spreads. A good security team treats reporting as the right call, not a confession.

If you run awareness training, make this concrete. Give staff one channel, one sentence to send ("I may have entered my password on a phishing page"), and a promise of no blame. The wider set of daily habits is in Workplace Security Habits. The newer social engineering patterns, including voice clones of IT staff, are in AI-Powered Social Engineering.

Action checklist

• Confirm no work password is reused on any personal or third-party account
• Switch any work tool you use to SSO where the option exists
• Move work credentials out of personal notes and into the approved manager
• Save the helpdesk number and security reporting channel in your contacts now
• If you run training, publish a one-line, no-blame reporting instruction

Your complete checklist

• Make every password at least 15 characters and stop rotating on a schedule
• Replace truthful security-question answers with random strings stored in your manager
• Use a six-word random passphrase for your password manager master password
• Install a password manager on every device and import your browser-saved passwords
• Protect the vault with the strongest MFA it supports
• Fix every reused password, starting with email, banking and work
• Share passwords only through the manager's sharing feature
• Keep work and personal credentials in separate vaults
• Check your email addresses on Have I Been Pwned and subscribe to alerts
• For each exposed account, change the password, sign out other sessions and review recovery settings
• Turn on MFA for email, banking, password manager, cloud and social accounts
• Prefer passkeys or security keys over SMS wherever a site offers them
• Never approve an MFA prompt you did not start, and report it
• Create passkeys for your primary email and platform accounts
• Register two hardware keys for any account that relies on a hardware key
• Generate and store recovery codes offline or in your manager
• Remove stale phone numbers and emails from recovery settings
• Never reuse a work password, and prefer SSO for work tools
• Save your helpdesk number and report suspected compromise immediately

For a guided week-long version of these steps, follow the 7-Day Personal Security Reset.