Password security in 2026: what you need to know

In 2025, infostealer malware compromised 3.9 billion passwords across 5.8 million devices worldwide. Credential stuffing - where attackers use stolen username and password combinations to break into other accounts - accounted for 22% of all data breaches, making it the single most common way businesses get breached.

If that sounds alarming, it should. But the good news is that protecting your business against the vast majority of these attacks is straightforward, and most of it costs nothing beyond a bit of time and attention.

This replaces our 2022 guide. A lot has changed in four years: infostealers became a major threat, passkeys arrived, and the NCSC now recommends them over passwords. So we’ve rewritten this from the ground up.

Why password security still matters

Passwords are still how most people log into most things. Despite years of talk about a “passwordless future”, the reality is that passwords remain the primary line of defence for the majority of business applications.

That matters because credential theft is now industrialised. Malware like RedLine and Raccoon silently harvests saved passwords, browser cookies, and session tokens from infected devices. In 2024-2025, these infostealers lifted over 500 million passwords from compromised machines. Many of those credentials end up on dark web marketplaces within hours, sold in bulk to anyone willing to pay.

The UK Cyber Security Breaches Survey 2025 estimates that 612,000 UK businesses experienced a cyber breach or attack in the prior year. Compromised credentials were involved in nearly half of all breaches globally.

This isn’t just a big-business problem. Small and mid-size businesses saw infostealer detections jump 104% year-on-year. If anything, smaller firms are more attractive targets - they’re less likely to have dedicated security monitoring and more likely to have weak password practices.

What’s changed since 2022

When we wrote the original version of this guide, the advice was fairly simple: use long passwords, don’t reuse them, use a password manager, and turn on multi-factor authentication. All of that still holds. But the threat landscape has shifted in a few important ways.

Infostealers have overtaken phishing as the primary credential threat. In 2022, phishing was the main way attackers stole credentials. That’s still a problem, but infostealers - malware that silently harvests every saved password on an infected device - have grown dramatically. They don’t need you to click a dodgy link and enter your password. They just take it.

Passkeys arrived, and the NCSC now recommends them. The FIDO Alliance’s passkey standard replaces passwords with cryptographic keys tied to your devices. Getting there has been messier than the promise, but in April 2026 the NCSC made passkeys its first choice of login. More on this below.

The NCSC updated its guidance. The National Cyber Security Centre continues to move away from complexity requirements (no more mandatory special characters) and towards longer passwords, password managers, and technical controls like account lockouts.

MFA adoption has grown significantly. Around 70% of enterprise users now have some form of multi-factor authentication, up from much lower figures in 2022. This is encouraging, but it means the remaining 30% are increasingly conspicuous targets.

Passkeys: now the NCSC’s first choice

In our 2022 guide, we mentioned passwordless authentication as a promising future development. Four years on, passkeys are real and supported by Apple, Google and Microsoft. A passkey is a cryptographic key pair tied to your device and unlocked with your fingerprint, face or PIN, so it can’t be phished, guessed or reused. Passkeys are faster than passwords too: Microsoft’s data shows passkey sign-ins take about 8 seconds, compared with 69 seconds for a password plus MFA.

For a while the NCSC held back. In early 2025 it called passkeys not perfect but getting better and stopped short of a blanket recommendation. On 23^rd April 2026 it changed its advice: passkeys should now be the first choice of login wherever a service offers them, with a password manager and two-step verification for services that don’t. Its technical analysis found passkeys at least as secure as, and generally more secure than, the strongest password combined with two-step verification.

That doesn’t mean the rough edges have gone.

Support is uneven. Plenty of services still don’t offer passkeys, and those that do don’t all accept the same kinds: device-bound passkeys that never leave your hardware, or synced ones that back up to your Apple, Google or Microsoft account. Most don’t tell you which you’re getting.

Moving between ecosystems is awkward. A passkey created on an iPhone syncs to your other Apple devices, but using it on a Windows laptop or an Android phone is harder than it should be, and often means scanning a QR code from one device to another.

Recovery is the weak point. If someone loses their phone and can’t get into the account it syncs to, their passkeys may go with it. The usual fallbacks, an emailed link or an SMS code, reintroduce exactly the kind of phishable sign-in that passkeys were meant to remove.

Our view: use passkeys wherever a service offers them, keep your password manager and MFA for everything that doesn’t, and decide in advance how staff get back in when a phone is lost or replaced.

What a strong password actually looks like

The NCSC’s guidance is clear: length matters more than complexity. An 18-character password made up of three random words, something like “cactus-umbrella-railway”, is far harder to crack than “P@ssw0rd!”, which meets most complexity requirements but sits near the top of every attacker’s list. You can test both in our password checker.

The three-random-words approach works because it produces passwords that are both long and memorable. You don’t need uppercase letters, numbers, and symbols if your password is long enough - though adding them doesn’t hurt.

The key rules remain:

At least 12 characters, ideally 16 or more
Not based on personal information (names, dates, pets, your company name)
Never reused across accounts
Not previously exposed in a data breach

That last point is increasingly important. With billions of credentials circulating on the dark web, the odds that a password you’ve used before has been compromised are uncomfortably high. Only 3% of passwords currently meet NIST’s best practice requirements, and an estimated 94% are reused across two or more accounts.

Password managers

If you’re still expecting people to remember unique, long passwords for every account, you’re expecting the impossible. The answer is a password manager - software that generates, stores, and auto-fills credentials so that humans only need to remember one master password.

We recommend third-party password managers over browser-based ones. Browser password managers (Chrome, Safari, Edge) are better than nothing, but they lock you into a single browser ecosystem, offer limited sharing and auditing features, and are vulnerable to malicious browser extensions - which is particularly concerning given the infostealer threat.

A dedicated password manager like Keeper, 1Password, or Bitwarden gives you:

Cross-platform access across all devices and browsers
Secure credential sharing without revealing passwords
Audit tools to monitor password reuse and security compliance across your team
Policy enforcement (minimum complexity, no master password reuse, mandatory MFA)
Shared credential management for company-wide accounts

The master password matters. Your password manager is only as secure as the master password protecting it. Make it long, make it unique, never reuse it anywhere else, and always protect it with MFA.

Multi-factor authentication

MFA remains the single most impactful thing you can do to protect your accounts. Even if a password is stolen, an attacker can’t get in without the second factor.

The hierarchy of MFA methods, from strongest to weakest:

Passkeys and hardware security keys (YubiKey, etc.) - phishing-resistant, and the strongest option wherever they’re supported
Authenticator apps (Microsoft Authenticator, Google Authenticator) - generate time-based codes on your phone
Push notifications - tap to approve on a trusted device
SMS codes - better than nothing, but vulnerable to SIM-swapping attacks

We’d recommend authenticator apps as the baseline for most businesses. They’re free, widely supported, and dramatically more secure than SMS. For administrator accounts and anyone with access to sensitive systems, hardware security keys are worth the investment. And wherever a service offers passkeys, use them: they do the job of a password and a second factor in one step.

A note on SMS: It’s fashionable to dismiss SMS-based MFA entirely. That’s unhelpful. SMS MFA is significantly better than no MFA at all. If SMS is the only option a particular service offers, use it. Don’t let perfect be the enemy of good.

Single sign-on

Single sign-on (SSO) lets your team access multiple applications with a single set of credentials, managed centrally through a provider like Microsoft Entra ID (formerly Azure AD).

The security benefit is substantial. Instead of every employee maintaining dozens of separate passwords across different services, they authenticate once against your identity provider - protected by strong MFA - and that trust extends to connected applications.

For IT administrators, SSO simplifies onboarding, offboarding, and access control. When someone leaves the business, you disable one account and their access to everything disappears. No more hunting through individual services wondering whether they still have access.

SSO works well with most major business applications - Microsoft 365, Google Workspace, Salesforce, Zoom, and many more. If you’re on Microsoft 365 E3 or above, you already have Entra ID included in your licence.

Password security doesn’t require a massive budget or a dedicated security team. For most SMEs, these five steps will protect you against the vast majority of credential-based attacks:

Use a password manager across your entire organisation. Not optional, not “encouraged” - required.
Enable MFA on everything. Start with email and admin accounts, then extend to all business applications. Use authenticator apps at minimum.
Implement SSO if you’re on Microsoft 365 or a similar platform. Centralise authentication and reduce the number of passwords your team needs.
Run a credential audit. Check whether any of your company’s credentials have appeared in known breaches. Services like Have I Been Pwned make this straightforward.
Use passkeys wherever they’re offered. The NCSC now recommends them as the first choice of login. Keep your password manager and MFA for services that don’t support them yet, and plan how staff get back in when a phone is lost.

If you’re working towards Cyber Essentials certification, you’ll need a formal password policy covering most of the above. That’s one of the things we help our clients with.

This replaces our 2022 password security guide. To check whether a password has appeared in a known breach, try our password checker.