7 Password Myths Security Experts Want Dead

Password advice has a long memory. Rules invented decades ago still circulate in corporate policies and family group chats, years after the evidence turned against them. Here are seven that security professionals keep having to bury, and the reasoning that killed each one.

Myth 1: You should change your passwords every 90 days

The claim: Regular rotation limits damage. Fresh passwords are safer passwords.

Why people believe it: It was official guidance for decades, and it feels like hygiene, like changing the oil in a car. Many corporate IT policies still enforce it, which makes it look current.

The reality: Forced rotation makes passwords weaker. When people must change a password on a schedule, they make the smallest possible edit: Winter2025 becomes Winter2026, Password7 becomes Password8. Attackers know these increment patterns and try them automatically. NIST SP 800-63B now recommends against scheduled expiration. Change a password when there is a reason: a breach notice, a shared account, a suspicious login. Otherwise leave a strong password alone.

Myth 2: A password needs symbols and numbers to be strong

The claim: No symbol, no security. Composition rules guarantee strength.

Why people believe it: Nearly every signup form enforces it, and a password full of symbols looks strong.

The reality: Strength comes from randomness and length, not character classes. Humans satisfy symbol rules predictably: capital first, digit and exclamation last, a for @. Cracking tools apply these exact mutations to wordlists, so P@ssw0rd1! dies in seconds while a random 16 letter lowercase string survives centuries of brute force. The math: 16 random lowercase letters give about 75 bits of entropy; 8 characters drawn from all 94 printable symbols give about 52. NIST now recommends against mandatory composition rules and favors length, screening against breached password lists, and allowing long passphrases. See how to create a strong password for the full math.

Myth 3: Never, ever write a password down

The claim: Paper is the ultimate security failure.

Why people believe it: The image of the sticky note on the monitor. In shared offices, that was a real and visible risk, so the rule generalized to everywhere.

The reality: Threat model matters. The attackers coming for your accounts are overwhelmingly remote: phishing, credential stuffing, database breaches. None of them can read a paper in your desk drawer. A written copy of your password manager master passphrase, stored somewhere physically secure at home, is a sensible recovery backup, and far better than choosing a weak memorable password to avoid writing anything. The rule that survives: never write passwords where strangers or coworkers pass by, and prefer a manager for everything except the one master secret.

Myth 4: Online password checkers are dangerous to use

The claim: Typing your password into any checker hands it to a stranger.

Why people believe it: The instinct is sound. Sending your real password to an unknown server would be a genuine mistake, and some shady sites have existed.

The reality: The nuance is where the check runs. A client-side checker evaluates the password in your browser with JavaScript and sends nothing over the network; that is safe to use. A checker that submits your password to a server is one to avoid. Breach-lookup services handle this a third way: the well-designed ones use k-anonymity, sending only the first few characters of a hash so the service never sees the password or even its full hash. Check what a tool does before you type. Our password strength checker runs entirely in your browser. And test candidates or lookalikes, not the exact string you already deployed, if you want zero exposure.

Myth 5: Eight characters is enough

The claim: Eight characters was the standard for years, so it must be adequate.

Why people believe it: Countless systems set 8 as the minimum, and people read a minimum as a recommendation.

The reality: Eight is a floor, not a target, and offline cracking hardware has grown relentlessly. An 8 character password, even fully random with symbols, sits near 52 bits, within reach of serious GPU rigs attacking a leaked database of weakly hashed passwords. A human-chosen 8 character password is far weaker still. For manager-generated passwords use 16 or more characters; length is free when software types it. For memorized secrets use five or six random words. NIST agrees, and revision 4 of SP 800-63B raised the floor to match: systems must now require at least 15 characters when the password is the only factor, keeping 8 only for passwords used inside multi-factor authentication, while supporting 64 characters or more.

Myth 6: Incognito mode protects your passwords

The claim: Private browsing keeps logins safe from hackers.

Why people believe it: The name suggests invisibility, and the mode does hide something: your local history.

The reality: Incognito only prevents the browser from saving history, cookies, and form data on that device after the session ends. It does nothing against phishing pages, keyloggers, malware, network snooping, or a breached website leaking your password. Your password’s safety depends on its strength, its uniqueness, and the site’s security, none of which private browsing touches. Use incognito for shared computers; use unique strong passwords and two-factor authentication for actual account security.

Myth 7: Biometrics have replaced passwords

The claim: Fingerprint and face unlock made passwords obsolete.

Why people believe it: Daily experience. Most people unlock their phone dozens of times a day without typing anything.

The reality: Biometrics are a convenient front door on top of a password or cryptographic key, not a replacement. Your phone still demands the PIN or password after a restart, and that secret protects the keys that make the fingerprint sensor meaningful. Biometrics also have a hard limitation: they are identifiers you cannot rotate. A leaked password gets changed; a leaked fingerprint is permanent. Passkeys are a genuine step toward fewer passwords, but they too sit behind device unlock, and the accounts backing them still need strong recovery secrets. Keep a strong master passphrase; the passphrase generator will make you one.

The pattern behind the myths

Every myth above shares one flaw: it judges security by appearance or ritual instead of by how attacks actually work. Rotation looks diligent, symbols look strong, paper looks careless. The evidence says otherwise, and modern guidance follows the evidence. Long, random, unique, stored in a manager. Everything else is decoration.