Password guidance

We often get asked by our customers:

• "What password policy do you recommend?"
• "Do you have recommendations on passwords, pass phrases and so on?"

Yes, we do. Here they are, so they benefit everyone.

The policy

Three different kinds of account need three different lengths. A service account is never typed by a human, so there is no reason to be modest about it.

Alongside the lengths:

• Expiry: 365 days
• Minimum age: 1 day
• Complexity requirements: optional

Complexity being optional is the part that surprises people, so it is worth being explicit about why. Complexity rules are what produce Password1! and Summer2025!. Length is what makes a password expensive to attack. When you have the length, the character-class rules mostly buy you predictable substitutions.

The awareness work beside it

A policy is a control. It does not teach anybody anything, and the gap between the two is where most weak passwords live. Three things are worth educating people on:

• What actually makes a password strong
• Why re-using a password across accounts undoes the rest
• Why sharing a password is a decision with consequences for somebody else

And multi-factor, everywhere

Both the policy and the awareness work lead to the same place: enforce multi-factor authentication everywhere you can. A password that has been cracked, shared or found in a breach is a much smaller problem when it is not sufficient on its own.

How to choose a pass phrase

Not a password. A pass phrase.

• Use a pass phrase instead of a traditional password
• Avoid family member names, and avoid pets
• Avoid using the company name
• Mis-spell words, or mix words from multiple languages
• Choose length over complexity

Alex1961! is a weak password.

eating 2day bottle is a strong pass phrase.

The second one is longer, easier to remember and harder to attack, and it breaks every complexity rule the first one satisfies.

Good practice

Beyond the policy itself, five habits:

• Audit passwords monthly
• Identify shared passwords, and act on them
• Implement controls that block weak passwords outright
• Multi-factor everywhere
• A PAM solution, with admin password rotation every 8 to 24 hours

Auditing monthly is the one that gets skipped, and it is the one that tells you whether any of the rest is working. We have written about what an audit like that finds in practice.

Need help?

We do password analysis and password policy implementation. If you have a password question that is neither of those, ask it anyway. info@pbsecurity.dk