Passwords today: what has changed and what really matters

Length beats complexity: the new ground rule

Many password rules date from a time when eight characters including special characters were considered secure. Today, attackers do not try passwords by hand but with programs that test enormous numbers of combinations and check known patterns first. That is exactly why forced complexity achieves little: “Password” becomes “P@ssw0rd!”, and attackers’ tools have long known this pattern. What really increases the effort for attackers is length, because with every additional character the number of possible combinations grows dramatically.

The Bundesamt für Sicherheit in der Informationstechnik, or BSI (Germany’s Federal Office for Information Security), takes this into account: a password can be long and less complex, for example 20-25 characters from two character types, or shorter and complex, for example 8-12 characters from four character types. In practice, the long variant works well as a passphrase, a sequence of several unrelated words that is easy to remember but hard to guess. More important than any complexity rule is another point anyway: every account needs its own password, because a password captured at one service is typically tried by attackers at many other services soon afterwards.

For your internal password policy, this means: raise the minimum length, drop the special character requirement, prohibit reuse. Where your systems support it, it is also worth checking new passwords against lists of passwords that have appeared in earlier data leaks, meaning data thefts that have become known. That nobody can memorize dozens of unique passwords is not an objection but the reason for one of the next building blocks: the password manager.

Forced password changes: why the old rule has had its day

For years, many companies had a rule requiring password changes every 90 days. Well intentioned, but often counterproductive in effect, because people who have to change constantly choose predictable patterns. “Summer2025!” becomes “Autumn2025!”, or a digit simply moves up by one. Such patterns are easy for attackers to guess, and the passwords tend to become weaker rather than stronger with each forced change.

The BSI therefore recommends changing passwords when there is a specific reason rather than by the calendar. Such occasions include a reported data leak at the provider, suspected phishing, meaning fake messages or login pages designed to capture credentials, a malware infection, or the departure of a person who had access to a shared account. Dropping the routine change does not lower security if, in return, length, uniqueness, and multi-factor authentication are in place, meaning a second proof of identity is required in addition to the password.

Before you switch off forced changes in your systems, an honest note: some contracts, insurance terms or industry requirements still explicitly mandate regular password changes. Check such external requirements first and document the change so that you can justify the new policy to customers or auditors.

Introducing a password manager in your company

A password manager is a program that stores all credentials in encrypted form, generates strong passwords and enters them automatically when you log in. Users only need to remember a single good master password, the main password that unlocks access to the manager. Only then does the rule that every account gets its own long password become workable in everyday use.

For business use, more matters than the pure storage function. Look for central user management, for team vaults, meaning shared storage areas with tiered access rights, for a defined procedure for revoking access when employees leave the company, and for a recovery option for forgotten master passwords. Access to the manager itself must be secured with multi-factor authentication, because it bundles the keys to the entire company.

For the rollout, a staged start has proven effective: first IT and management, then department by department. Existing passwords from browser storage and spreadsheets are migrated, and the old storage locations are then deleted. For a small team, this is manageable on your own. As soon as the manager is to be connected to central user management, for example Microsoft Entra ID, the central sign-in service of the Microsoft cloud, support from a service provider is usually the faster route.

Multi-factor authentication: the second lock

Multi-factor authentication, often called MFA or two-factor authentication, requires a second, independent proof of identity in addition to the password, for example a numeric code from your smartphone or a fingerprint. The benefit is substantial: a stolen password alone is then no longer enough to log in.

The variants differ in how robust they are. One-time codes from an authenticator app, meaning time-limited numeric codes generated by an app on your smartphone, are a good standard. Hardware security keys, small devices that plug into a USB port or are held against the device, are considered particularly resistant to phishing. Codes sent by SMS are the weakest variant, but still clearly better than no second factor at all. For tap-to-approve push notifications, you should choose a setting that requires matching a displayed number. Otherwise, annoyed users will eventually approve someone else’s login attempts as well.

If you have to prioritize: start with email accounts, because almost all other passwords can be reset through them. Then come administrator accounts, remote access such as VPN, meaning encrypted connections into the company network, and central cloud services. With most services, the feature is already included and only needs to be switched on.

Passkeys: signing in without a password, explained simply

A passkey is a sign-in method that works without a password. During setup, your device generates a key pair: the secret part stays on the device and is unlocked by fingerprint, facial recognition or PIN, while the online service receives only the public part. When you sign in, you briefly confirm your identity on the device, and the technology handles the rest in the background. There is nothing to type, nothing to forget and, above all, nothing that could be captured by phishing or reused from a stolen database.

The BSI recommends using passkeys wherever services offer them. Today they are practically available mainly at the large platforms, for example Google, Microsoft, and Apple accounts, as well as at many widely used online services. Through the operating system account or a password manager, passkeys can be transferred to multiple devices, and for devices that are not your own there is sign-in by QR code.

In day-to-day business, a sober look pays off: where sign-in runs through a large platform, for example Microsoft 365, passkeys are already well usable today. Many industry applications, on the other hand, do not yet support them, and almost everywhere the password remains as a fallback. For now, passkeys therefore do not replace your password rules and multi-factor authentication; they complement them. A sensible entry point is a pilot with a small group, combined with a clear rule for lost devices, for example by registering several devices per person.

Shared accounts: unloved, but everyday reality

Almost every business has accounts used by several people: the central info mailbox, social media profiles, supplier and government agency portals, or point-of-sale systems. From a security perspective, such accounts are awkward. It is impossible to trace who did what and when. Someone who leaves the company still knows the password. And multi-factor authentication is often tied to the private mobile number of a single person.

The first question is therefore: does the account really have to be shared? Many services offer personal logins with roles and approvals, and email systems support shared mailboxes that each person accesses with their own login. Where that is possible, it is the cleaner solution.

For the remaining cases: the password belongs in a team vault of the password manager, not on slips of paper or in spreadsheets. Name a responsible person for each account, change the password as soon as someone with access leaves, and store the second factor not on a private device but as a one-time code in the password manager or on a jointly kept hardware key. A simple inventory list of all shared accounts is what makes the topic manageable in the first place.

Where to start: a workable sequence

If you want to approach the topic in a structured way, this sequence has proven effective. First: enable multi-factor authentication for email, administrator accounts and remote access. Second: introduce a password manager and replace browser storage and password lists. Third: modernize your password policy, meaning raise the minimum length and drop the special character requirement and routine changes, as long as no external requirements stand in the way. Fourth: inventory shared accounts and move them into team vaults. Fifth: activate passkeys where your services offer them, starting with a pilot group.

An honest assessment: a small company can take the first steps well on its own. Switching on MFA and setting up a password manager for a manageable team are not major projects. It becomes more demanding when policies need to be enforced centrally, many legacy accounts need to be migrated or central sign-in services need to be connected. Bringing in external support for that saves time and avoids gaps that nobody notices in daily operations. Overall, plan in weeks rather than days, and involve your staff early: the best rule is useless if it is circumvented in everyday work.