Longer beats weirder, every time

Modern password cracking does not work the way most people imagine. Nobody sits there typing guesses. An attacker who obtains a database of password hashes runs them against hardware that tries enormous numbers of candidates per second, guided by dictionaries of real passwords from previous breaches and by rules that encode exactly the substitutions humans make. Replacing an a with an @ and putting a 1 on the end does not slow that down at all, those transformations were built into cracking rules two decades ago.

What actually adds difficulty

Length does. Each additional character multiplies the search space, and the effect compounds fast. A four-word passphrase drawn from a large word list is dramatically harder to crack than an eight-character password with a symbol in it, and it has the enormous practical advantage of being something a human can actually type and remember. This is why current guidance from NIST moved away from mandatory complexity rules and arbitrary expiry, and toward length, screening against known breached passwords, and not forcing rotation without cause.

Forced ninety-day rotation in particular did measurable harm. People responded exactly as you would expect: Summer2024! became Autumn2024!, and the pattern was more predictable than the original. Change a password when there is a reason, a breach, a suspected compromise, a departing employee who knew it, rather than on a calendar.

How to build a passphrase

Pick four or more unrelated words at random. Not a phrase from a song, not your kids' names in order, not something a person who follows you online could construct. Random selection is the whole point, which is why using a generator beats using your imagination, human-chosen words cluster hard around common nouns.

Add a separator and a little variation if a site demands it, but do not sacrifice length to satisfy a complexity rule. A passphrase like copper-lantern-drift-nine is both stronger and easier to type on a phone than something like Xk7#pQ2z, and you will not end up writing it on a note under the keyboard.

• Four words minimum, five or six for anything that protects money or client data
• Chosen at random, not from memory or meaning
• Never reused across two accounts, ever
• Screened against known breached passwords. Our breach check covers this
• Different and longer for your email account than for anything else

That last point deserves emphasis. Your email account is not one account among many; it is the master key to every other account, because that is where password resets land. If an attacker owns your inbox, they own your banking portal, your Microsoft 365 tenant, your domain registrar and your payroll system by simply asking each one to send a reset link. Give your primary email the longest passphrase you have and the strongest second factor available.

None of this works if you are trying to hold it in your head, which brings us to the two tools that make the whole approach practical: a password manager and multi-factor authentication.

Rolling this out properly means deploying a business password manager with shared vaults for the credentials teams genuinely need in common, enforcing MFA through conditional access in Entra ID rather than leaving it to individual choice, removing standing administrator rights from daily-use accounts, and auditing what is actually in use rather than what policy says should be. Most of the messy findings turn up in that last step: service accounts with passwords set in 2019, a shared login to the accounting system, a departed employee still in a group.

We do this work as part of Pod Guard, our layered security service, and it is one of the first things the free Deep Dive assessment looks at for a new client. It pairs naturally with email authentication, endpoint protection and monitored backups, identity is the front door, but it is not the only door.

If you want to see where you stand before talking to anyone, run our dark web scan to find out whether credentials tied to your domain are already circulating, and the IT risk score for a broader picture. Both are free and both are listed alongside our other free IT tools.

One closing thought for anyone weighing whether this is worth the effort. In nearly every small-business security incident we are called into, the entry point is not some exotic exploit. It is a password that was reused, an account without a second factor, or an inbox rule quietly forwarding mail to a stranger. The unglamorous controls are the ones that hold.

Identity is the perimeter now. Everything else is a second line.Orca IT, Gilbert AZ