The more I learn about password security, the simpler my passwords get

The more leaks and hacks in the news, the more I find myself wondering—what’s the ideal password?

For years, I’ve based my definition off expert advice. You want long, random, unique. But lately I’ve thought the answer is actually less specific than that.

I’d say the ideal password is simple—while still strong, too. And what fits that definition can change depending on the context. Hear me out.

Welcome to Safe Mode, your weekly report for pressing security and privacy news—and what steps to take next. Want this newsletter to come directly to your inbox? Sign up on our website!

In some cases, the ideal password is actually a passkey. (So not a password at all.) They’re the epitome of simple and secure. No memorization and not reusable, with baked-in elements of two-factor authentication. For these reasons, I recommend their use first to most people.

Meanwhile for websites that lack passkey support, an ideal password is indeed something long, random, and unique—something easily generated and stored by a password manager. You’ll spend as little effort on a 32-character password as you would an 8-character version.