Passwords are too weak, and people are exhausted by password rules (numbers, symbols, uppercase); security fatigue is setting in. This is leading to terrible habits resulting in passwords like Summer2026!. Computing power has caught up with old security advice. AI-driven brute-force algorithms are cracking them mathematically in seconds.
Strong security today is actually easier than the old rules. As a leading Sussex tech repair and cybersecurity support service, we see the aftermath of weak credentials every day. This post will outline the modern, expert-backed way to secure your accounts so you don't have to worry.
The New Golden Rule
Password length provides the most difficulty for cracking software, whereas throwing a ! or a 123 at the end of an 8-character word does almost nothing. However, many sites still follow this outdated password advice.
The new advice is the UK NCSC (National Cyber Security Centre) three random words rule. For example, "velvetmountainstapler" (Don't use this one!) is stronger than "Repair123!". Three random words create a 15+ character password that takes computers centuries to crack, but the human brain can instantly visualize and remember it easily. However, it is still not recommended to use 3 words with a connection like "manchesterunitedgoal" as these are common and cracked faster.
What You Should Stop Doing!
You don't need to reset your password every 90 days if you don't want to! Authorities like NIST and the NCSC—two government cybersecurity sectors—advise against forcing regular password expirations.
This is because when users are forced to change passwords constantly, they resort to predictable, repeatable patterns (like changing Summer2025! to Summer2026!). Modern advice now dictates that a strong password should be kept indefinitely unless there is evidence or any suspicion of a data breach or a compromise. If you ever feel your device or accounts have been compromised, professional IT support in Sussex can always help audit your security.
2026 Password Safety Toolkit
Password Managers: Password managers are the gold standard for modern security. They generate extremely complex passwords that can be regularly rotated, and it makes it easier not to have to remember different passwords for every site—all you need to remember is one master password. Some we regularly recommend and set up for clients here at Sussex Tech Repair (No Sponsors) are Bitwarden, 1Password, and KeePassXC (KeePassXC is more advanced and has no cloud backup).
Multi-Factor Authentication: Personally, I believe multi-factor auth should be compulsory for any website, and it is slowly being required by a lot of sites you will know like Google, Facebook, etc. Even if a password is leaked or brute-forced, an app-based authenticator or hardware key puts another step in the way of attackers. Personally, I suggest avoiding SMS, WhatsApp, and email 2-factor solutions as these can be disabled in SIM-swapping attacks.
Breach Monitoring: This is something I suggest checking every couple of months/annually, but not to get obsessed with. Websites like Have I Been Pwned allow you to check your current credentials against known database leaks to see if your account has been in a known data breach.
Conclusion
Password cracking and account takeovers have evolved over time, becoming more complex; however, new security and management tools have made it easier than ever to create, store, and manage secure account credentials.
The main advice I'd give anyone trying to improve their digital security—whether you're managing a personal laptop or running a business network relying on our Sussex IT support—would be to use a password manager, have a strong master password created using 3 or more random words, and use MFA (Multi-Factor Authentication) on any account that allows you to.