# Password Best Practices: Passkeys & MFA > Protect your accounts with strong passwords, passkeys and MFA - a plain-language guide to phishing-resistant authentication for people and for teams. By Lucas · June 14, 2026 · 7 min read · Hardening Source: https://bluwarden.com/blog/password-best-practices-2026 --- ## The big shift: 2026 is the year passwords start dying The headline change since the early 2020s: **passkeys are now mainstream.** Apple, Google, Microsoft, and most major services support them, and many now offer passkey-only sign-in. A passkey is a cryptographic key stored on your device (phone, laptop, hardware key) that logs you in with your fingerprint, face, or device PIN. There's no secret to type, leak, phish, or reuse. **Bottom line for 2026:** use a passkey wherever it's offered. Where you still need passwords, follow the rules below. Most people will live in a hybrid world for a few more years - some accounts passkey, some password - so you need both habits. --- ## Why this still matters Passwords remain the weakest link in most breaches. In 2026 the threat landscape is worse, not better: - **Credential stuffing** - attackers take username/password pairs from old breaches and try them on every other site. Works because people reuse passwords. - **AI-assisted phishing** - generative AI writes flawless, personalized lures at scale; fake login pages are pixel-perfect. The "look for bad grammar" advice is dead, and [attacker-in-the-middle kits](/blog/what-actually-breaks-company-security-2026) now steal the session even when you have MFA. - **Faster cracking** - cheap GPU/cloud power and AI-guided guessing chew through short or predictable passwords in seconds. - **SIM-swapping** - attackers hijack your phone number to intercept SMS codes and take over accounts (the same channel abused by [smishing](/blog/smishing-anatomy-phone-protection)). - **Infostealer malware** - silently grabs saved passwords and session cookies from infected machines. The defenses that beat these are the same handful of habits, done consistently. --- ## The core rules ### 1) Length beats complexity Modern guidance (NIST SP 800-63B and successors) flipped the old advice on its head: - **Longer is stronger.** Aim for **16+ characters** for anything you type; let your password manager generate **20-30+ random characters** for everything else. - **Forget forced complexity rules.** "Must have an uppercase, a number, and a symbol" produces predictable patterns (`Password1!`). A long random string or a multi-word passphrase is far stronger. - **Passphrases work** for the few passwords you must memorize: **six or more** random words (e.g. `correct-harbor-glacis-tuna-velvet-piston`). Use a real random method (Diceware), not a meaningful sentence - five words is the weak end for anything protecting a lot, so default to six-plus for master secrets. ### 2) Never reuse a password This is the single most important rule. One unique password per account means one breach can't cascade across your digital life. The only realistic way to do this is a password manager - see below. ### 3) Stop rotating passwords on a schedule Forced 30/60/90-day changes are **no longer recommended** and were officially dropped from guidance. They push people toward weak, incremental passwords (`Spring2026!` -> `Summer2026!`). **Change a password only when:** - it appears in a breach, - you suspect compromise, or - it was shared and the relationship/need ended. ### 4) Screen against known breaches Good services and password managers now check your credentials against breach corpuses (Have I Been Pwned and similar). If a password shows up in a breach list, it's burned - replace it, even if it's long. --- ## Use a password manager (non-negotiable) A password manager is the foundation of everything above. It generates, stores, and autofills unique strong passwords so you only remember one. **What to look for in 2026:** - **Zero-knowledge / end-to-end encryption** - the vendor can't read your vault. - **Passkey support** - it can store and sync passkeys, not just passwords. - **Cross-platform** with reliable autofill on phone and desktop. - **Breach monitoring** built in. - **Independent security audits** published. - **A clear track record** on handling incidents (some major managers have had breaches - read how they responded). **Solid options:** Bitwarden (open-source, audited), 1Password, Proton Pass, and the built-in managers (Apple Passwords / iCloud Keychain, Google Password Manager). Built-in managers are good and free; dedicated managers are better if you span ecosystems (Windows + iPhone, etc.). **Critical:** your **master password** is the one you must get right. Make it a long passphrase (six random words minimum), never used anywhere else, and never recoverable by the vendor - which means **if you forget it, you lose the vault.** Write it on paper and store it somewhere physically secure (a safe), at least until it's muscle memory. --- ## Multi-factor authentication (MFA): turn it on everywhere A password alone is one factor. MFA adds a second, so a stolen password isn't enough. **Not all MFA is equal** - here's the 2026 hierarchy, best to worst: 1. **Passkeys / FIDO2 hardware keys (phishing-resistant)** - best. A YubiKey or a platform passkey can't be phished or replayed, because the credential is bound to the real site's domain. Use these for your most important accounts (email, bank, password manager, primary cloud). 2. **Authenticator app (TOTP)** - the 6-digit rolling codes from Google Authenticator, Aegis, Ente Auth, etc. Free and much better than SMS - but **not phishing-resistant**: a real-time attacker-in-the-middle page (Evilginx, Tycoon) can relay the code and steal your session in the moment. Good as a widespread second factor; for email, bank, and your password manager, prefer passkeys/FIDO2. 3. **Push-approval apps** - fine, but beware **MFA fatigue attacks** (attacker spams approvals hoping you tap "yes"). Use number-matching versions. 4. **SMS codes** - better than nothing, but vulnerable to SIM-swap and interception. Use only when it's the sole option, and never as the 2FA for your phone carrier or email. **Priorities:** protect your **email** and **password manager** first with the strongest MFA you can - they're the master keys that can reset everything else. --- ## Harden your account recovery (the back door everyone forgets) Attackers rarely beat a strong password - they go around it through recovery. Lock the back door: - **Recovery email/phone:** make sure your recovery addresses are themselves secured with strong MFA. A weak recovery email undoes a strong main account. - **Backup codes:** when you enable MFA, you get one-time recovery codes. Save them in your password manager and/or print them. Without them, losing your device can lock you out permanently. **One exception:** the recovery codes for the password manager *itself* - store those offline (printed, in a safe), never inside the vault they'd unlock, or a single vault compromise hands the attacker both the password and its fallback. - **Carrier account:** add a PIN/port-freeze with your mobile provider to blunt SIM-swaps. - **Security questions:** treat them as passwords, not facts. "Mother's maiden name" is public. Store random answers in your manager. - **Have a device-loss plan:** register **two** passkeys/hardware keys (a primary and a backup kept somewhere safe) so a lost phone doesn't lock you out. --- ## Spotting and surviving phishing in the AI era Since you can no longer rely on bad spelling or ugly design: - **Trust the domain, not the message.** Don't click links in unexpected emails/SMS. Navigate to the site yourself or use your password manager's autofill - **a manager won't autofill on a fake domain**, which is a built-in phishing alarm. - **Verify out-of-band.** "Your bank" texting about a problem? Call the number on your card, not the one in the message. - **Slow down on urgency.** "Act now or your account is locked" is the oldest manipulation, now AI-polished. - **Prefer passkeys** - they're cryptographically phishing-proof, which sidesteps this entire category. --- ## Special situations - **Sharing access:** don't text passwords. Use your manager's secure sharing, or a service's native "invite/delegate" feature. Revoke when no longer needed. - **Shared/family accounts:** use a family vault in your password manager rather than one password on a sticky note. - **Public/borrowed computers:** avoid logging into sensitive accounts; if you must, use a private window and log out. Assume keyloggers. - **Travel & high-risk:** consider a hardware security key, and review which accounts could be compelled or accessed at borders. - **Breach response:** if a service you use is breached, change that password immediately (and anywhere you reused it - then stop reusing), and watch for follow-on phishing using the leaked data. --- ## For teams and small businesses If you support others' security: - **Deploy a business password manager** with provisioning and recovery (so an employee leaving doesn't take vault access or lock you out). - **Mandate phishing-resistant MFA** (FIDO2/passkeys) for admin, finance, and email accounts at minimum. - **Kill scheduled rotation policies**; switch to breach-triggered resets and length minimums. - **Use SSO** (single sign-on) where possible to shrink the number of passwords employees juggle. - **Enforce unique, generated credentials** for service accounts and rotate secrets via a vault, not spreadsheets. - **Train against modern phishing** with realistic, AI-quality examples - and make reporting easy and blameless. - **Monitor for leaked corporate credentials** on breach/dark-web feeds. --- ## Summary 1. Use a **password manager**; one unique 16+ char (or generated) password per account. 2. Make your **master password** a long passphrase - and back it up physically. 3. Turn on **MFA everywhere**; use **passkeys/hardware keys** for email, bank, and your manager. 4. **Adopt passkeys** wherever offered. 5. **Don't rotate on a schedule**; change only on breach/compromise. 6. **Secure your recovery** paths and save backup codes. 7. Add a **carrier port-freeze/PIN** against SIM-swap. 8. **Verify domains**, never click login links from messages; let autofill be your phishing alarm. 9. **Check breaches** (Have I Been Pwned) and replace exposed passwords. 10. Forget complexity gimmicks - **length, uniqueness, and a second factor** win. --- *Want passwords, MFA, and recovery locked down across your team? [Get in touch](/#contact) - bluwarden can set up phishing-resistant authentication matched to your threat model.* *This guide is general best-practice advice, not a substitute for a security assessment tailored to your situation or compliance regime. For a setup matched to a specific threat model, consult a qualified security professional.*