Most account takeovers require no technical skill at all: all it takes is a password stolen through phishing, guessed, or reused from another website that has been breached. The good news is that the countermeasures are simple. Let us look at how to create strong passwords, why you should turn on two-factor authentication and what passkeys are.
What makes a password strong?
A password is strong when it is long, unique for each service and unpredictable. The rules have changed in recent years: the guidelines of NIST, the US reference body for security standards, in their final version of July 2025 (SP 800-63B-4), state that:
- the password must have at least 15 characters when it is the only sign-in factor (at least 8 if used together with a second factor);
- systems must accept long passwords, up to at least 64 characters;
- composition rules must not be imposed (one capital letter, one number, one symbol…), as they lead to predictable passwords such as “Office2026!”;
- periodic changes must not be forced: the password is changed only if there is a suspicion that it has been compromised;
- passwords should be checked against lists of already breached or overly common passwords;
- password managers and copy-and-paste should be allowed.
How to create a strong password that is easy to remember
- Use a phrase, not a word: four or five random words, such as “tile-cyclamen-river-october-pencil”. It is long, easy to remember and hard to guess.
- Do not use personal information: names, dates of birth, the name of your office, your favourite football team.
- A different password for every service. If a website is breached, criminals try the same combination everywhere.
- Let the password manager handle all the passwords you do not need to type from memory.
- Protect your “master keys” well: your email password and your password manager password. Whoever controls your email can reset almost everything else.
What is two-factor authentication (MFA)?
Two-factor or multi-factor authentication (MFA) asks for a second proof of identity in addition to the password: a code generated by an app, a notification to approve on your phone, a physical security key. Even if a criminal steals the password, they cannot get in without the second factor.
It is the measure with the best cost-to-effectiveness ratio. A 2023 Microsoft Research study estimated that MFA reduces the risk of compromise by 99.22% across the entire population analysed, and by 98.56% even when the password had already been stolen.
Which second factor should you choose?
| Method | Security | Notes |
|---|---|---|
| SMS | Basic | Better than nothing, but vulnerable to SIM cloning |
| Authenticator app (6-digit code) | Good | Works even without a network connection |
| Notification to approve | Good | Be careful not to approve requests you did not start |
| Physical security key or passkey | Very high | Resistant to phishing |
Where to turn it on first: email, certified email (PEC, where available), cloud management software, online banking, cloud storage, remote access to the office via VPN and administrator accounts. Stolen credentials are in fact one of the favourite ways in for ransomware.
Beware of a widespread scam: notification bombing. If you receive approval requests that you did not start, do not approve them and change your password immediately: someone knows it.
What are passkeys?
A passkey is a sign-in method that replaces the password with a pair of cryptographic keys: one stays on your device, the other on the website. To sign in you unlock your phone or computer with your fingerprint, face or PIN, and the device proves your identity without sending any secret.
The practical advantages:
- there is nothing to remember;
- they resist phishing: the passkey only works on the genuine website, so a fake site cannot obtain it;
- they cannot be stolen in bulk from a breached website, because the site only stores the public part.
Passkeys are a standard promoted by the FIDO Alliance and are already supported by the main services and operating systems. Where they are available, it is worth turning them on.
The password manager: do you really need one?
Yes. Nobody can remember dozens of long, different passwords. A password manager generates them, stores them encrypted and fills them in for you. It also has a hidden advantage against phishing: it does not fill in the password on a fake website, because the address does not match.
For an office, it is worth choosing a solution that allows controlled sharing of common credentials (for example, a portal used by several people) without writing them on sticky notes or in an Excel file.
Minimum rules for the office
- Mandatory MFA on email, cloud services and remote access.
- A password manager for everyone, with a long master password and MFA.
- Personal accounts, not shared: everyone has their own, so that the access log makes sense.
- When someone leaves the office, deactivate their accounts immediately.
- No passwords sent by email or chat.
Passwords protect accounts; the network must be protected separately, with a firewall that monitors and alerts. A network that notices repeated sign-in attempts, for example a hundred passwords tried in an hour on the VPN, and alerts the owner with a ready-to-approve action is one of the tasks of Strega Defence. For the full picture, try the 10-question checklist.
Frequently asked questions
How often should you change your password?
According to the NIST guidelines updated in 2025, there is no need to change it on a fixed schedule: it should be changed when there is a suspicion or evidence that it has been compromised, for example after a phishing attack or a breach of a website where it was used.
Is a complex password or a long password better?
A long password. A phrase of four or five random words is stronger and easier to remember than a short word full of symbols. Length matters more than complexity.
Is two-factor authentication via SMS secure?
It is much better than a password alone, but it is the least robust method, because your phone number can be hijacked. Whenever possible, choose an authenticator app, a physical security key or passkeys.
Is a password manager safe? What if it gets breached?
A good password manager stores your data encrypted with a key derived from your master password, which the provider does not know. The remaining risk is reduced by using a long, unique master password and turning on two-factor authentication on the password manager itself.
Do passkeys still work if I lose my phone?
Yes, in most cases, because passkeys can be synchronised in encrypted form between your devices through your operating system account or your password manager. It is still wise to set up a second sign-in method or recovery codes kept in a safe place.
Sources and further reading
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management — NIST, July 2025.
- Full text of SP 800-63B — NIST.
- How effective is multifactor authentication at deterring cyberattacks? — Microsoft Research, 2023.
- Passkeys — FIDO Alliance.
- Consigli utili per i dipendenti delle PMI (PDF) (in Italian) — ACN, the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale).
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
