Why passwords alone are not enough anymore

The scale of the problem

Billions of usernames and passwords from past data breaches are freely available on the internet. Security researchers regularly find collections containing more than ten billion leaked credentials. There is a real chance that at least one of your old passwords is already in one of these lists.

You can check for yourself on the website Have I Been Pwned, which tells you whether your email address has appeared in a known breach.

How attackers use leaked passwords

Most people reuse passwords across several websites. When one site is breached, attackers take the leaked email and password pairs and try them automatically on email providers, banks, social networks and business tools. This is called credential stuffing and it works far too often.

Attackers also use password spraying, where they try a few very common passwords like Password123 against thousands of accounts. And of course phishing pages trick people into typing their password straight into a fake login form.

What makes a strong password

Length matters more than complexity. A long passphrase made of four or five random words is both easier to remember and much harder to crack than a short password full of symbols.

• Use at least 12 to 16 characters.
• Never reuse the same password on two websites.
• Avoid names, birthdays and common words on their own.
• Use a password manager so you only need to remember one strong master password.

Add a second factor

Two factor authentication, often called 2FA, asks for something you have as well as something you know. Even if a password leaks, the attacker still needs your phone or security key to log in. Microsoft has reported that enabling it blocks more than 99 percent of automated account attacks.

Not all second factors are equal. Authenticator apps like Google Authenticator or Microsoft Authenticator are safer than SMS codes, because text messages can be stolen through SIM swapping. Physical security keys offer the strongest protection of all.

Passkeys are the future

Passkeys replace passwords completely. Instead of a secret you type, your device creates a unique cryptographic key for each website. Signing in only takes a fingerprint, a face scan or your device PIN.

Passkeys cannot be phished because they only work on the real website they were created for. They cannot be reused because every site gets a different key. Apple, Google and Microsoft all support them and more websites add them every month.

What your business should do today

Start with the accounts that matter most: email, banking, domain registrar, hosting and your website admin panel. If an attacker gets into your email, they can reset the password for almost everything else.

• Roll out a password manager for the whole team.
• Require two factor authentication on every business account.
• Offer passkeys or 2FA to your own customers.
• Remove access immediately when someone leaves the company.