Passphrases and Password Managers: What Actually Works

For years, password policies demanded uppercase and lowercase letters, a number, a symbol and a new password every 90 days. The result was predictable: passwords like Summer2026# followed by Fall2026#, written on sticky notes or reused across sites. The rules made passwords harder for people to remember without making them much harder for attackers to guess.

Current guidance takes a different approach. NIST SP 800-63B, the federal guideline for digital identity and authentication, focuses on length, screening against known-compromised passwords and removing rules that push users toward weak habits.

Length beats complexity

Attackers rarely guess passwords one at a time. They use lists of previously breached passwords and rules that mimic how people modify them, such as capitalizing the first letter and adding a number and symbol at the end. Complexity rules make passwords look random but follow patterns that cracking tools already expect.

Length is what makes guessing expensive. A passphrase of several unrelated words is long, easy to type and easy to remember. What current guidance recommends for organizations that set password policy:

• Set a meaningful minimum length and allow long passwords, including spaces, so passphrases are practical.
• Drop composition rules that require specific mixes of character types.
• Screen new passwords against lists of commonly used, expected and previously breached passwords, and reject matches.
• Remove password hints and security questions, which are often guessable from public information.
• Allow paste into password fields so people can use password managers.

Stop forced rotation without cause

NIST SP 800-63B advises against requiring periodic password changes. When people are forced to change passwords on a schedule, they make small, predictable changes, and an attacker who has an old password can often guess the new one.

Rotation still matters when there is a reason for it. Require a password change when there is evidence of compromise: the password appears in a breach dataset, an account shows suspicious activity, a device is lost, or an employee who knew a shared credential leaves. Event-driven changes protect the organization without training users to cycle through variations.

Check your contractual and regulatory obligations before changing policy. Some frameworks and older contract language still reference specific password settings, so align your policy with the requirements that apply to you and document the rationale.

Password managers make unique passwords practical

The most damaging password habit is reuse. When one website is breached, attackers try the same email and password combinations everywhere else. Nobody can remember a unique, strong password for every account, which is exactly the problem password managers solve.

• Use an enterprise password manager with central administration, so the organization can enforce policies, share credentials securely within teams and recover access when someone leaves.
• Protect the vault with a strong passphrase and MFA. The vault is now a high-value target.
• Generate random passwords for everything stored in the manager. Only a handful of passwords, such as the vault and device logins, need to be memorable.
• Retire shared spreadsheets and documents that hold passwords in plain text.

Password managers also help against phishing. Many will only fill credentials on the exact site they were saved for, so a convincing look-alike login page gets nothing.

MFA is still required

Even a strong, unique password can be phished, captured by malware or exposed in a breach. Multifactor authentication limits what an attacker can do with a stolen password. Prioritize it for email, remote access, cloud consoles, privileged accounts and anything that touches sensitive or controlled unclassified information.

Not all MFA is equal. Codes sent by text message and simple push approvals can be intercepted or abused through repeated prompts. CISA recommends phishing-resistant MFA, such as FIDO2 security keys, passkeys or smart cards like PIV and CAC, for the accounts that matter most. Our hardening engineers help organizations roll out phishing-resistant MFA for administrative and remote access.

What this looks like as a policy

• Require long passwords or passphrases and screen them against compromised-password lists.
• Remove complexity rules and scheduled expiration, and force changes only on evidence of compromise.
• Provide an approved password manager and train staff to use it.
• Require MFA everywhere it is supported, with phishing-resistant methods for privileged and remote access.
• Monitor for credential stuffing and password spraying against your login portals.

Frequently asked questions

Are passphrases really stronger than complex passwords? A long passphrase of unrelated words is generally much harder to guess than a short password that follows a familiar pattern. Avoid famous quotes and song lyrics, which appear in cracking lists.

Is it risky to keep all passwords in one manager? The vault is a concentrated target, but a well-protected manager with MFA is far safer than reused or written-down passwords.

Does this guidance apply to CMMC? NIST SP 800-171 includes password and authenticator requirements. Map your policy to the version your contracts reference, and our CMMC team can help you document it for an assessment.