Passwords, Passkeys & MFA: What Actually Works
Passwords, passkeys & MFA: what actually works.
Most password advice people remember is out of date. Here are the current rules from NIST and CISA, how to build passwords you can remember, and which kinds of multi-factor authentication (MFA) really stop attackers.
The modern password rules
NIST Special Publication 800-63B-4, finalised in 2025, is the reference most organisations follow. It replaced complexity theatre with rules based on how passwords are really attacked.
| Old habit | Current guidance (NIST SP 800-63B-4) |
|---|---|
| 8 characters with upper, lower, digit and symbol | At least 15 characters when the password is the only factor, at least 8 when it is used with MFA. Allow at least 64 characters. |
| Forced mix of character types | No composition rules. Length matters far more, and rules push people to predictable patterns like Summer2026!. |
| Change every 90 days | No scheduled expiry. Force a change only when there is evidence of compromise. |
| Anything that passes the rules is fine | Block common and breached passwords by checking new ones against a blocklist. |
| Security questions and hints | Don’t use them. Answers are easy to research or guess. |
| Block pasting into password fields | Allow paste and password managers. |
Passphrases you can remember
The easiest way to reach 15+ characters is a passphrase: several random, unrelated words. The UK NCSC popularised “three random words”; for important accounts, use four or more.
- Random means random. Song lyrics, quotes, names and keyboard patterns are in attackers’ wordlists.
- Never reuse a password. Reuse is how one leaked website password becomes a hacked email account.
- Check exposure. Services such as Have I Been Pwned tell you if your email address appeared in a known breach.
- Memorise only a few: your device login, your email account and your password manager. Let the manager handle the rest.
Password managers
A password manager generates a long, unique password for every site and fills it in only on the real website, which also helps against fake login pages.
- Choose a reputable manager, built into your platform or standalone, that supports MFA and passkeys.
- Protect it with a long passphrase you don’t use anywhere else, plus MFA.
- Set up the recovery or emergency-access option so you are not locked out.
- Move your most important accounts first: email, banking, work and social media.
MFA, ranked from strongest to weakest
Any MFA is far better than a password alone, but they are not equal. This ranking follows CISA’s guidance.
| Method | Resists phishing? | Notes |
|---|---|---|
| FIDO2 / WebAuthn: passkeys and hardware security keys | Yes | CISA calls phishing-resistant MFA the gold standard. The login is tied to the real website, so a fake site gets nothing usable. |
| PKI smart cards | Yes | Common in government and large enterprises. |
| Authenticator-app push with number matching | Partly | Stops blind “approve” taps during MFA-fatigue attacks, but a convincing fake page can still relay the login. |
| Authenticator-app codes (TOTP) and hardware OTP tokens | Partly | Good for most people; a real-time phishing proxy can still capture a code. |
| Push approval without number matching | No | Vulnerable to push bombing. Turn on number matching. |
| SMS or voice codes | Weakest | Exposed to SIM swapping and interception. Still better than no MFA. |
Passkeys in plain language
A passkey replaces the password with a cryptographic key pair. The private key stays on your phone, computer or security key, unlocked by your fingerprint, face or PIN, and the website only ever stores the public key. Because each passkey works only on the site it was created for, it cannot be typed into a fake page or leaked in a database breach.
- Turn on passkeys first for your email, Microsoft, Google and Apple accounts.
- Keep at least two ways in: a synced passkey plus a security key, or saved recovery codes.
- Remove SMS as a fallback once a stronger method works, where the service allows it.
Checklist for IT admins
- Set minimum length to 15 for password-only systems and screen new passwords against a breached-password list.
- Remove complexity rules and scheduled expiry; reset on evidence of compromise.
- Rate-limit failed sign-ins and alert on password spraying across many accounts.
- Require MFA for email, VPN, remote access and cloud consoles; require phishing-resistant MFA for administrators.
- Turn on number matching for push MFA and block legacy authentication protocols that cannot do MFA.
- Give every Windows machine a unique local admin password with LAPS. See our Windows hardening checklist.
- Make account recovery as strong as sign-in; helpdesk resets are a favourite attacker target.
Sources: NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (2025); CISA, Implementing Phishing-Resistant MFA and Implementing Number Matching in MFA Applications; UK NCSC password guidance; FIDO Alliance. Reviewed November 2026.
MAG212 CYBER offers network and cybersecurity consultation, penetration testing with MAG212 Atlas, and security seminars for organisations around the world.