Passwords and Two-Factor Authentication: What the Numbers Actually Say
This article is advertising-funded. It recommends a product we hold a commercial affiliate agreement for, and every commercial link on the page is labelled partner link. If you buy after following one, the advertiser pays us a commission — your price is the same either way.
What that does not buy: a rating, a testimonial or a deadline. Read the editorial policy for what we refuse to publish, and the affiliate disclosure for how the money flows.
More successful attacks begin with a working password than with malware. That makes credentials the highest-value thing to get right — and the area where the conventional advice, with its mandatory symbols and ninety-day rotations, has been quietly abandoned by the standards bodies that invented it.
What entropy measures
Password strength has a precise definition, and it is narrower than most people assume. Entropy, in bits, is the base-two logarithm of the number of equally likely possibilities:
bits = length × log2(alphabet size)
That is arithmetic, not measurement. The chart below applies it to six common recipes.
Every figure above assumes each character or word was chosen uniformly at random. A password you invented is not. Capitalising the first letter, appending a year, substituting 3 for e and ! for the final character are the first transformations any cracking rule set applies. A twelve-character password you thought of yourself does not have 78.8 bits of entropy; it has however much entropy your habits left in it, and that is usually far less.
This is the entire argument for a password manager, and it is not about convenience. A generator produces genuinely uniform output, so the arithmetic above actually applies to what it produces. Nothing you can remember has that property.
Why the old advice changed
The rules most of us learned — one uppercase, one digit, one symbol, changed every ninety days — were withdrawn by the US National Institute of Standards and Technology in its Digital Identity Guidelines (SP 800-63B), and the UK NCSC reached similar conclusions. The reasoning is empirical rather than theoretical: composition rules push people toward a small number of predictable patterns, and forced rotation makes it worse, because a password changed under protest becomes the same password with an incremented digit.
What the current guidance favours instead: length over composition; no mandatory rotation unless there is evidence of compromise; screening against known breached passwords; and allowing long passphrases and the full character set, including spaces.
Reuse is the actual problem
When a service is breached, the stolen credentials are replayed automatically against other services — credential stuffing. It does not require any skill and it does not need to crack anything. A unique password per site means one breach stays one breach; a reused one means the breach reaches your email, and your email is the reset mechanism for everything else.
If you change one thing after reading this, make it your email account: a unique password nowhere else, and the strongest second factor the provider offers.
You can check whether an address of yours appears in a known breach corpus at Have I Been Pwned, which is free and does not require you to submit a password.
Where a security bundle fits into this
Some security subscriptions add breach-alerting, which tells you when an address of yours appears in a leak. Surfshark Antivirus is sold within the Surfshark One bundle; we hold a paid affiliate agreement with the advertiser. Check which components the current bundle includes on Surfshark’s own page — the composition has changed over time and we will not list features we cannot verify today.
See Surfshark AntivirusOpens in a new tab Partner link — opens surfshark.com via our redirect We earn a commission if you buy through this link. It costs you nothing extra and does not change the price you are quoted.Password managers
The objection is always the same: is it not dangerous to put every password in one place? The honest answer is that it concentrates risk, and that the alternative concentrates it worse.
Without a manager, the realistic behaviours are reuse, a predictable scheme, or a document on the desktop. A reputable manager encrypts its vault on your device with a key derived from a master password the provider never receives, which is why a breach of the provider does not hand over readable vaults — provided the master password was strong.
A genuine secondary benefit, often overlooked: a manager fills credentials only on the domain it saved them for. Presented with a convincing replica on a different domain, it simply declines to fill, which makes it a quiet anti-phishing tool. See our phishing guide.
What to look for: independently audited, published cryptographic design, end-to-end encryption with zero knowledge at the provider, working export so you are not locked in, and support for the platforms you use. Browser-built-in managers are a reasonable starting point and are far better than reuse; dedicated managers generally offer better cross-platform behaviour and sharing.
Second factors, ranked
Not all second factors resist the same attacks. Ranked from strongest:
| Method | Resists phishing? | Notes |
|---|---|---|
| Passkey or hardware security key (FIDO2 / WebAuthn) | Yes | Cryptographically bound to the site’s domain by the browser. A replica on another domain cannot obtain anything usable, regardless of what the user believes. |
| Push approval with number matching | Partly | Better than a plain Approve button, which is defeated by repeated prompts until the user taps to stop the noise. Never approve a prompt you did not initiate. |
| Time-based one-time codes from an app (TOTP) | No | A real improvement over SMS and a large improvement over nothing. Still phishable: a code can be typed into a fake page or read aloud to a caller. |
| One-time codes by SMS | No | Vulnerable to SIM-swap and interception, and phishable like any code. Still much better than no second factor — use it where nothing else is offered. |
| Email codes | No | Only as strong as the email account, which is often the thing being protected. Weakest of the options here. |
Whatever you enable, print the recovery codes and keep them somewhere physical. The commonest way people lose an account to two-factor authentication is not an attacker — it is a lost phone and no way back in.
A workable routine
- Install a reputable password manager. Give it a long, random master password you write down once and store physically until it is memorised.
- Fix your email account first: unique generated password, strongest available second factor, recovery codes printed.
- Then banking, then anything holding payment details, then everything else as you naturally sign in over the following months. There is no need to do it in one sitting.
- Turn on a passkey wherever one is offered. Adoption is uneven but growing quickly.
- Never reuse a password across sites. This is the whole exercise.
- Change a password when there is a reason — a breach notification, a suspicion, a shared secret — not on a calendar.
Sources
- NIST SP 800-63B, Digital Identity Guidelines — the standard that withdrew composition rules and mandatory rotation.
- NCSC password guidance — UK National Cyber Security Centre.
- FIDO Alliance on passkeys and the W3C WebAuthn specification — how domain binding works.
- Have I Been Pwned — breach-exposure lookup.
- The Diceware method — origin of the 7776-word list used in the chart above.
Product behaviour changes without notice. Where anything here differs from a vendor’s own current documentation or terms, the vendor’s information prevails. Tell us about any divergence at info@savorin.online and we will correct the page.
Written by Isla Ward, Director of publication for BohDo Fast Transport s.r.o.. Published and last reviewed 22 September 2026. General information, not security advice tailored to your circumstances. All diagrams on this page are original SVG files produced for savorin.online. The entropy figures shown are calculated from the formula given above, not measured. Editorial policy and corrections procedure.