“Mix in numbers and symbols, and change it regularly.” That was the advice for years. It is not what the current guidelines say.
Both the US guidance (NIST) and its Japanese equivalents changed position over the last decade. No forced rotation. No mandatory mixture of character types. What they ask for instead is simpler.
Length is doing almost all the work
To someone guessing, the effort grows as the number of character types raised to the power of the length. Length is the exponent; character variety is only the base. Adding one to the exponent beats nudging the base. That is what “length decides it” means.
The real danger is reuse
Most real-world compromises are not someone breaking your password. They are a password leaked from one service being tried on another. Nothing about strength prevents that — only not having used it twice.
Which makes all different the first priority, and that is past what anyone can hold in their head. A password manager, or the browser’s own storage; either is fine. Using neither has stopped being realistic.
Why scheduled changes were dropped
Because what people do was predictable. Told to change every three months, they produce `Sakura2026-1`, then `Sakura2026-2`. To anyone guessing, that is barely a change at all.
The time to change is when you have reason to think it leaked. Forcing changes at other times only pushes people toward something weaker and easier to remember, which is why the guidance dropped it.
So what should you do
- Do not reuse. This is the highest-value habit. Even if only email, banking and social accounts get their own.
- Make it long. Past about fifteen characters, guessing stops being practical. For anything you must remember, stringing unrelated words together buys length cheaply.
- Turn on two-factor. It holds even when the password leaks — a higher priority than making the password clever.
- Protect the important ones properly. Perfection everywhere does not last. Treat your email account as special: whoever holds it can reset everything else.
For generating one, this site has a password generator. It makes both random strings and word-based passphrases, and shows the strength in bits, so “is this enough” has a number attached. It runs in the browser and nothing generated is sent anywhere.
Overturning advice you have followed for years feels wrong. But the guidance changed because the evidence of what actually gets broken came in. Effort spent adding symbols goes further spent on length and on not reusing.
The stem separation in this article runs free in your browser — no sign-up, and your audio never leaves your device.