A strong password is still your first line of defense at work and at home — even when you also use multifactor authentication (MFA). MFA blocks a lot of takeovers. It does not replace a long, unique password that nobody else has seen.
You do not need to memorize policy jargon. Aim for length, uniqueness, a password manager, MFA when it is offered, and a change only when something looks wrong. That matches what NIST, CISA, and Microsoft recommend today.
Related: business email compromise — why a weak or reused email login still matters when payment requests show up.
Why a strong password still matters with MFA
MFA is a second check after your password — usually an app code, a push on your phone, or a security key. If nobody has your password, they never reach that second step.
If they do get your password, MFA can still stop them — unless they also trick you into approving a prompt or sharing a code. Passwords still unlock password managers, recover many accounts, and protect systems that do not have MFA yet. Keep a strong password as the baseline. Turn on MFA so a stolen password is much less useful on its own.
What you should do (the short list)
Old habits asked for short passwords, mixed symbols, and a forced change every few weeks. That often produced guessable patterns like Summer2024!, then Summer2025!.
Here is the modern recipe for you:
- Go long — Aim for 15+ characters when the password is the only factor. With MFA on, systems may allow as few as 8, but longer is still better. CISA’s tip for people: at least 16. Microsoft’s stronger recommendation is 14.
- Skip forced symbol soup — You do not need a special mix of uppercase, digits, and symbols just to look “complex.” Length beats clever punctuation.
- Use a unique password everywhere — One strong password per account. Reuse is how a shopping-site leak can open your work email.
- Use a password manager — Let it create and remember long secrets so you do not have to.
- Change when something is wrong — Not on a calendar. Change after a breach notice, reuse of a leaked password, a suspicious page, odd sign-in alerts, or when IT asks.
- Turn on MFA — Especially for email, banking, and work logins.
How to pick a strong password
A strong password is long, hard to guess, and unused anywhere else.
- Length first — Start at 15+ characters. Stretch to 16+ when you can. Longer is stronger.
- Try a passphrase — Four to seven unrelated words work well. Spaces are fine. Example shape: orchid subway lemon suitcase — ordinary words, not a song lyric or quote. Or let your password manager generate a random string and autofill it.
- Skip personal trivia — Names, birthdays, pet names, team slogans, and CompanyName2026! are easy to guess.
- Never reuse — A solid work password reused on a store site is how inbox and payroll risk meet.
If a website still demands short “complex” rules, use your password manager’s generator for that site only. Do not recycle a password you use somewhere else.
Unique passwords + a password manager
Reuse is the quiet risk. If one site leaks your password — or someone phishes it — attackers try that same password on your email, bank, and work apps. A unique password for each account keeps the damage to one place.
A password manager creates long random passwords — each a unique strong password — stores them behind one strong master passphrase, autofills logins, and flags weak or duplicated entries. Protect the manager itself with a long passphrase and MFA if the product offers it.
Browser built-in savers can get you started. A dedicated manager is usually easier for work and personal accounts together. The habit that matters: every new account gets its own strong password, not a small edit of the last one.
When to change your password
Forced monthly or quarterly changes trained people to make tiny, predictable edits (Password47! → Password48!). That helps attackers more than it helps you. Microsoft prefers passwords that never expire for many Microsoft 365 accounts, and modern guidance says: change when there is a real reason.
Change your password when:
- You get a credible breach notice for that service
- You reused that password somewhere that was compromised
- You shared it, typed it on a suspicious page, or saw unexpected sign-in alerts
- IT asks you to rotate after an incident
Otherwise, a long unique strong password plus MFA beats shuffling the same password on a timer.
Turn on MFA everywhere it is offered
MFA asks for a second proof after the password — an authenticator app, a security key, a push with number matching, or biometrics on your device. Turn it on for every account that offers it, especially email, banking, social, and work systems.
Prefer an authenticator app or a security key when you can. Text-message codes are better than nothing, but apps and keys are stronger. MFA does not replace a strong password. It sharply cuts what a leaked password can do alone — which is why it shows up next to email and payment risk, including business email compromise.
How LTS can help
LTS helps Kern County teams make everyday logins safer without busywork.
- Use MFA at work — We help you get set up with authenticator apps and stronger options for accounts that matter.
- Ask IT about a password manager or single sign-on — Fewer passwords to remember, and unique ones where you still need them.
- Practical habits — Length, uniqueness, and what to do if something looks off.
- Ongoing support — Monitoring and help so identity basics stay current. Explore cybersecurity and managed IT.
Questions about MFA, a company password manager, or a login that feels off? Speak with an IT expert.
Related: Business email compromise · Cybersecurity · Contact