---
title: "Passwords"
canonical_url: https://www.janbrennenstuhl.eu/topics/passwords/
author: Jan Brennenstuhl
---

# Passwords

Password policies that people can follow, systems that do not punish password managers, and the attacks on reused credentials.


Passwords are not going away soon, so they should at least be handled well: long passphrases allowed, password managers welcomed, reuse detected. The field guide has the research; the essays have the implementation advice.


## Entries

- [What should a password policy require?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/) (2026-10-13, guide): NIST SP 800-63B-4 sets a 15-character minimum for single-factor passwords, forbids composition rules and periodic changes, and requires blocklist checks and support for password managers. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/index.md
- [Password Attack Guide: What is Password Spraying?](https://www.janbrennenstuhl.eu/password-spraying/) (2023-05-11, essay): Password spraying tries a few common passwords across many accounts to avoid lockouts, so defenders need failed-login monitoring, bot management and MFA, and passwordless login removes the target entirely. Markdown: https://www.janbrennenstuhl.eu/password-spraying/index.md
- [Passwordless: Critical Notes on FIDO2 Passkeys](https://www.janbrennenstuhl.eu/fido-passkeys/) (2023-05-08, essay): Passkeys resist phishing but replace knowledge with possession and tie users to devices and Big Tech vendors, so most people should wait for the ecosystem to mature before going passkey-only. Markdown: https://www.janbrennenstuhl.eu/fido-passkeys/index.md
- [Long Password Support for Safer Login Systems](https://www.janbrennenstuhl.eu/long-password-support/) (2023-05-06, essay): Login systems should accept long passwords from users and password managers, hash them with Argon2id or scrypt, and still set an explicit maximum length to prevent hashing denial of service. Markdown: https://www.janbrennenstuhl.eu/long-password-support/index.md
- [Max Password Length: A Secure Password Guide](https://www.janbrennenstuhl.eu/max-password-length/) (2023-05-04, essay): Length matters more than complexity: use unique passwords of at least 12 to 16 characters, and services should not cap passwords below 64 characters. Markdown: https://www.janbrennenstuhl.eu/max-password-length/index.md
- [Do password strength meters work?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/) (2023-05-03, guide): Password strength meters produce stronger passwords when users change passwords on important accounts, but make no observable difference on unimportant ones. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/index.md
- [How common is password reuse?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/) (2023-04-27, guide): Somewhere between 43% and 51% of users reuse the same password across multiple sites. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/index.md
- [How to Design a Strong & Usable Password Policy](https://www.janbrennenstuhl.eu/password-policy/) (2023-04-26, essay): A strong, usable password policy requires at least 12 characters, checks guessability, blocks common and breached passwords, and drops composition rules and forced password changes. Markdown: https://www.janbrennenstuhl.eu/password-policy/index.md
- [How to: Password-Manager Friendly Login Forms](https://www.janbrennenstuhl.eu/password-manager-friendly/) (2023-04-23, essay): Login forms work well with password managers when inputs carry the right autocomplete values, length rules sit in pattern or passwordrules attributes, and the site offers /.well-known/change-password. Markdown: https://www.janbrennenstuhl.eu/password-manager-friendly/index.md
- [How do you protect accounts from stolen credentials?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/) (2023-04-21, guide): Checking credentials against breach data and adding device and location risk signals to the login decision reduce the risk from stolen passwords. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/index.md