Password Security Checklist

NIST SP 800-63B requires a minimum of 15 characters for passwords used as a single factor and recommends accepting at least 64 characters. It also rejects mandatory character-composition rules. Predictable substitutions made to satisfy a symbol rule often add less resistance than their visual complexity suggests.

The operational priority is a different generated value for every service. Start at 16 characters where compatibility is uncertain and 24 or more for important or administrative accounts, subject to the service's limits. For the one master password you must remember, use a long passphrase made from unrelated words.

A password manager makes long, unique credentials usable without memorization. Autofill can also avoid entering a credential on a look-alike domain, which may be safer than manually copying it. Protect the master password and recovery path as high-value credentials.

Individuals should decide where recovery codes live. Teams should separate private and shared vaults. Do not paste shared credentials into chat or email; use sharing that supports access control, audit history, and revocation.

A long password can still be stolen when entered into a convincing fake site. Passkeys and security keys can provide phishing resistance by cryptographically binding authentication to the legitimate site. Prioritize them on important services that support them.

Authenticator-app codes can improve on SMS-only recovery in many situations, but they can still be phished. Whatever the method, keeping every recovery factor on one phone creates a single point of failure when the device is lost.

Open the legitimate service from a bookmark or typed address before changing a compromised credential. A breach notice can be copied by opportunistic phishing campaigns, so avoid treating an email login button as proof of destination.

After the change, review login history, recovery email and phone, MFA methods, connected applications, API keys, and active sessions. If the old value was ever reused, replace it everywhere with separate generated values.

Shared user IDs reduce accountability and make offboarding difficult. Issue named accounts wherever possible and limit access with roles. If sharing is unavoidable, record the owner, purpose, vault location, and rotation trigger.

API keys and database credentials are service secrets, not user passwords. Keep them out of source code and public repositories, separate them by environment, and design rotation so one leaked credential can be revoked without a full-system outage.