Common Password Myths, Debunked

Some of the most repeated password advice is outdated, oversimplified, or was never quite right to begin with. Here are the myths that persist anyway, why they took hold in the first place, and what's actually true according to current guidance.

Myth: You should change your password every 30–90 days

Modern guidance from NIST and other standards bodies actively recommends against mandatory periodic rotation for accounts without evidence of compromise. Forced rotation tends to produce small, predictable variations of the same password rather than genuinely new ones — see our password rotation guide for the full reasoning behind this shift.

This myth persists mainly because it was standard corporate policy for so long that it became assumed wisdom, even after the research behind it was revisited and the guidance changed. Many organizations are still catching up to the updated recommendation.

Myth: Adding a symbol or number automatically makes a password strong

Swapping "e" for "3" or appending "!" is such a common pattern that cracking tools test for it by default. It adds far less protection than it feels like it should. Length and genuine randomness matter more than hitting a character-type checklist — see our entropy guide for the underlying math.

Myth: Security questions are a solid backup layer

Answers to questions like "mother's maiden name" or "first pet" are often discoverable through public records or social media, or guessable through common answers. Treat them as a weak point, not a security feature — some services now let you enter a random string instead of a real answer, which is worth doing where available.

Myth: A password manager is a single point of failure to avoid

The alternative — memorizing or reusing passwords — creates far more actual risk. Reputable password managers use encryption specifically designed so the company itself can't read your stored data, meaning even a breach of their servers doesn't directly expose your passwords. See our password managers explained guide for the mechanics behind this.

Myth: Longer passwords are inconvenient without real benefit

The inconvenience is real for passwords you type manually, but a password manager eliminates that cost by autofilling — so length stops being a tradeoff once you're not the one typing it every time.

Myth: My accounts aren't valuable enough to be targeted

Most attacks aren't personally targeted at all — they're automated, testing millions of leaked credentials against every major service simultaneously. Your account doesn't need to be individually interesting to end up in that sweep; it just needs a password that was reused somewhere that got breached.

Myth: A password with a mix of upper and lowercase is automatically random

Capitalizing the first letter of a word — the single most common capitalization pattern humans use — barely changes the effective guessing difficulty, because cracking tools already test the capitalized version of every dictionary word by default. True randomness means the capitalization itself is unpredictable, not just present.

Myth: If a site doesn't require a strong password, a weak one is fine

A site's password requirements reflect its own minimum bar, not a recommendation. Plenty of sites still allow surprisingly weak passwords for compatibility or legacy reasons — that doesn't mean a weak password is actually safe there, only that the site won't stop you from choosing one.

Myth: Antivirus software makes weak passwords less risky

Antivirus software protects against malware running on your device — it does nothing to stop a leaked or guessed password from being used directly against a website's login page from somewhere else entirely. These are separate layers of protection addressing separate threats, and one doesn't substitute for the other.

Myth: Using your browser's autofill is inherently insecure

Browser autofill is generally safe for the passwords it stores, and it does at least discourage manual reuse. It's simply a less feature-rich option than a dedicated password manager — missing things like breach monitoring, secure sharing, or cross-browser sync — not a security risk in itself.

Frequently asked questions

Conclusion

Most password myths trace back to advice that made sense in an earlier context, or that got oversimplified along the way. The current, evidence-based version is simpler than the myths suggest: long, random, unique passwords, stored in a manager, backed by two-factor authentication where available.

Related articles

Free tools for this guide