First publication date: 04.05.2023
Passwords remain a central component of IT security - but their role is changing. This change became clear once again on World Password Day in April 2025: Passkeys and passwordless login procedures are becoming increasingly important, in addition to traditional passwords and multi-factor authentication (MFA).
The US National Institute of Standards and Technology (NIST) now officially recommends this:
https://www.nist.gov/cybersecurity/how-do-i-create-good-password?utm_source=chatgpt.com
Use passphrases with 15 or more characters (e.g. "coffee-jam-saturn-luminous"). They are easier to remember, much harder to crack - and comply with NIST recommendations. Complexity rules with special characters and capital letters often lead to worse habits and more frustration.
Password reuse is a systemic risk: if one is compromised, many others are at risk. NIST strongly advises against this and recommends the use of blocklists for password filtering.
Avoid rigid rules such as "at least one capital letter + one number + one special character". The length of the password is more important. Instead, supplement your security strategy with filters for passwords that have already been leaked (e.g. via the HaveIBeenPwned API).
MFA remains essential - ideally with phishing-resistant factors such as security keys (FIDO/U2F), passkeys or biometric authentication.
A password manager makes your everyday life easier: it creates secure, random passphrases, recognizes reuse, warns of leaks and stores everything in encrypted form.
These are easy to guess or can be researched publicly. Modern recovery processes rely on email magic links or additional MFA steps instead.
If you continue to rely on email for account recovery, use a separate email account exclusively for this purpose - with no connection to your personal or business communications. Protect it with strong MFA.
Passkeys enable logins via biometrics or PIN - and are resistant to phishing attacks.
Forced changes often lead to weak variants or passwords being written down. NIST recommends changes only if a compromise is suspected.
New studies show: Accessible two-factor authentication - with multi-device support, biometrics and passwordless alternatives - significantly improves the user experience for people with disabilities.
Traditional passwords remain a fallback for the time being, but the security world is clearly moving towards passwordless approaches, passkeys and intelligent MFA.
Long, unique passwords + MFA + password manager remain the tried-and-tested combination.
But if you want the best possible protection in 2025, there's no getting around passkeys and real-time leak detection.
