¿Por qué tener una contraseña segura es más crucial ahora que nunca?

A strong password matters more now than it ever has, but almost everything the internet taught you about building one has been formally retired. The rules most of us learned — mix four character types, change it every ninety days, never write it down — are no longer what the standards bodies recommend. In August 2025 the US National Institute of Standards and Technology published Revision 4 of SP 800-63B, and it does not merely soften the old advice; it forbids much of it.

The threat picture explains why. Attackers rarely sit there guessing your password one attempt at a time. They buy credentials dumped from a breach at another site and replay them, they phish you into typing the password yourself, or they steal it from your machine with an infostealer. Against those attacks, an eight-character password stuffed with punctuation is not meaningfully safer than an eight-character word — and it is far more likely to be reused, because you cannot remember it.

This guide sets out what actually protects an account today: length over complexity, uniqueness over rotation, a manager instead of memory, and phishing-resistant second factors wherever you can get them. Where the older advice was wrong, it says so plainly.

What actually threatens your passwords now

Getting the defence right depends on knowing which attack you are defending against, because the countermeasures are different.

Credential stuffing and reuse

This is the volume attack. Email-and-password pairs from historical breaches are packaged and replayed automatically against unrelated sites. If you reuse a password anywhere, a breach at the weakest site you ever signed up to becomes a breach of your email, your bank and your cloud storage. No amount of complexity helps — the attacker already has the exact string. Only uniqueness helps.

You can find out whether a specific password already sits in those corpora. Services built on the Pwned Passwords dataset use k-anonymity, sending only the first five characters of the password's SHA-1 hash to the server and doing the final comparison locally, so the password itself never leaves your browser. A pwned password checker works this way; if a password you use appears there, change it today rather than at some scheduled review.

Phishing and adversary-in-the-middle

Phishing bypasses password strength entirely — you hand the secret over yourself. Modern kits proxy the real login page in real time, capturing the password and the one-time code and logging in before the code expires. Attackers manufacture urgency ("your account closes in 24 hours") to stop you checking the domain. Voice phishing does the same by phone, with the caller posing as your bank or an IT helpdesk.

Offline cracking after a breach

When a site is breached, the attacker gets the password database and can attack it offline at enormous speed. Here password length genuinely is the deciding factor, but so is the site's choice of storage algorithm — which is out of your hands. This is the scenario where a long passphrase pays for itself and a short one, however punctuated, does not.

Infostealers, social engineering and shoulder surfing

Malware from a fake advert, a cracked download or a phishing attachment can lift every saved credential and session cookie from a machine in seconds. Low-tech methods still work: watching someone type a PIN, or spidering their social profiles for the pet names and birth years that turn up in security answers. That last one is why NIST says verifiers SHALL NOT prompt people to use knowledge-based authentication — "your mother's maiden name" is public data, not a secret.

What a strong password means under NIST SP 800-63B Rev 4

NIST's Digital Identity Guidelines are the reference most regulators and enterprise security teams follow. Revision 4, published on 26 August 2025 by the National Institute of Standards and Technology, rewrote the password rules around evidence rather than habit. The table below contrasts the folklore with the current requirements.

Old advice	What SP 800-63B Rev 4 actually says
8 characters is enough	Verifiers SHALL require at least 15 characters for a password used as a single factor; at least 8 only when it is part of multi-factor authentication
Cap passwords at 16 or 20 characters	Verifiers SHOULD permit a maximum length of at least 64 characters
Force upper, lower, number and symbol	Verifiers SHALL NOT impose composition rules requiring mixtures of character types
Change your password every 60–90 days	Verifiers SHALL NOT require periodic password changes; they SHALL force a change only on evidence of compromise
Block spaces and "unsafe" characters	Verifiers SHOULD accept all printing ASCII characters, the space character, and Unicode
Disable paste on password fields	Verifiers SHOULD permit the paste function, to facilitate password manager use
Offer password hints and security questions	Hints accessible to an unauthenticated visitor are prohibited, and knowledge-based authentication SHALL NOT be used when choosing passwords
Complexity stops guessing attacks	Rate limiting is the primary defence: verifiers SHALL implement a mechanism that limits failed authentication attempts
Any password you invent is fine	Verifiers SHALL compare new passwords against a blocklist of commonly used, expected or compromised values

Why length beats complexity

Composition rules fail because people satisfy them predictably. Told to add a capital, a number and a symbol, most users produce Password1! — and cracking tools model exactly that behaviour. NIST's commentary notes that research shows users respond in very predictable ways to composition requirements, which is why imposing them went from recommended to prohibited.

Length cannot be pattern-matched away. Four or five random words are easy to type and hard to attack; a fifteen-character passphrase you can recall beats a nine-character jumble on a sticky note. Test candidates with a strength test rather than trusting the coloured bar on a signup form, which usually just counts character classes.

Why rotation schedules made things worse

Mandatory expiry produced incremental passwords — Spring2024! becoming Summer2024! — which are trivially predictable, and it trained people to treat password changes as an annoyance rather than an incident response. The rule now is simple: keep a strong unique password indefinitely, and change it immediately if there is any evidence it has been exposed. That single reversal is the biggest practical difference between old and current guidance.

How to set up passwords you can actually live with

The realistic obstacle is volume. NordPass's 2026 survey of its own users reported an average of around 120 personal passwords plus 67 work-related ones — a self-selected sample from a password manager's customers, so treat the exact figure as indicative rather than universal, but the order of magnitude is right. Nobody memorises a hundred unique strings. The system, not your memory, has to do the work.

1. Install a password manager and let it generate everything. Once the manager holds the secrets, length costs you nothing — generate 20 or more random characters per site and never look at them.
2. Create one long master passphrase. This is the one you memorise. Use four or five unrelated words, at least 15 characters total, unique to the manager and never typed anywhere else. Do not reuse your email password for it.
3. Generate, do not invent. Human-chosen "random" strings are not random. A password generator produces values with no pattern for cracking rules to exploit.
4. Check the important ones against breach data. Run your email, banking and primary cloud passwords through a breach lookup before you rely on them.
5. Turn on multi-factor authentication everywhere it is offered. Prioritise your email account first: it is the reset path for everything else.
6. Replace passwords with passkeys where the site supports them. Every account that moves to a passkey is one that can no longer be phished or credential-stuffed.
7. Delete accounts you no longer use. Dormant accounts still hold your data and still get breached.
8. Fix reused passwords in priority order. Email and password manager first, then finance, then anything holding payment details, then the rest.

A few habits still matter regardless of setup: be sceptical of links and attachments, shield keypads and screens from onlookers, avoid entering credentials on untrusted public Wi-Fi, and keep endpoint protection current on every device. None substitutes for unique passwords, but each closes a route passwords alone do not cover.

Beyond passwords: second factors, passkeys and biometrics

A strong password is a floor, not a ceiling. What sits on top of it determines whether a phishing attempt succeeds.

Authentication method	Phishing-resistant?	Practical notes
Password alone	No	Needs 15+ characters and must be unique per site
SMS one-time code	No	NIST classifies PSTN out-of-band as a restricted authenticator; better than nothing, worst of the second factors
Authenticator app (TOTP)	No	Not phishable in bulk, but a real-time proxy phishing kit can relay the code
Passkey / FIDO security key	Yes	Cryptographically bound to the site's domain, so a lookalike domain gets nothing

How passkeys actually work

A passkey is a FIDO (Fast Identity Online) credential: a public and private key pair created for one specific site. The public key sits on that site's server; the private key never leaves your device or synced keychain and is never transmitted. Your device signs a challenge instead, and because the signature is bound to the real domain, a lookalike phishing page cannot produce a valid response — there is no shared secret to steal and nothing to type into the wrong box.

One nuance worth knowing: passkeys that sync across your devices through a cloud keychain are called syncable authenticators, and NIST states they SHALL NOT be used at AAL3, the highest assurance level, because the private key must be exportable to sync. For ordinary consumer accounts that is irrelevant; for high-assurance systems, a hardware security key is the answer.

Where biometrics really fit

This is where old advice most often garbles things. Your fingerprint or face does not travel to the website and is not a password. NIST treats biometrics as a way of unlocking an authenticator you physically hold: the sensor confirms you are the person holding the device, and the device performs the cryptography. The two underlying processes are identification, matching a sample to a user profile, and verification, confirming a sample matches a claimed identity. Fingerprint, facial, iris and voice recognition all work as inputs — but each unlocks a key rather than replacing one.

Where a code-based second factor is your only option, an authenticator app beats SMS. A TOTP generator shows how those six-digit codes are derived from a shared seed and the current time, which also makes clear why a code relayed to an attacker within its 30-second window is still usable by them.

If you build the login form: storing passwords correctly

Everything above assumes the site is holding up its end. Users cannot compensate for bad server-side storage, so if you are the one writing the code, the rules are short and non-negotiable.

Store a salted hash from a deliberately slow, memory-hard algorithm — Argon2, scrypt or bcrypt — never a raw or lightly hashed password. General-purpose digests are built to be fast, which is exactly the wrong property here: a SHA generator or a generic hash generator illustrates how quickly a modern machine chews through candidates, and an MD5 generator demonstrates an algorithm that is broken for this purpose and should never appear in an authentication path. A bcrypt generator is the closer analogue to what a password store should do, with a tunable work factor.

Beyond hashing: enforce the 15-character minimum, accept at least 64 characters, allow spaces and Unicode, allow paste, drop your composition rules and expiry timer, screen new passwords against a breach blocklist, and rate-limit failed attempts. Most of these are deletions rather than features — the rare security upgrade that reduces the code you maintain.

Frequently asked questions

How long should a strong password be?

At least 15 characters when the password is your only factor — that is now a NIST requirement for verifiers, not a suggestion. Eight characters is acceptable only when the password is one factor inside multi-factor authentication. If a manager is generating and storing it, use 20 or more; the length costs you nothing.

Do I still need uppercase, numbers and symbols?

No. NIST explicitly states that verifiers SHALL NOT impose composition rules requiring mixtures of character types, because people satisfy them in predictable ways that cracking tools already model. Add length instead. If a site still forces the old rules, comply and make the password longer than the minimum.

Should I change my passwords every 90 days?

No. Current guidance says verifiers must not require periodic changes, because scheduled rotation produces predictable incremental variants. Change a password when there is evidence of compromise — a breach notification, a hit in a breach dataset, a suspicious login — and otherwise leave a strong unique password alone.

Are password managers safe to use?

Yes, and current guidance is written to support them: NIST says verifiers should permit pasting into password fields precisely to facilitate password manager use. The concentration risk is real, so protect the manager with a long unique master passphrase and multi-factor authentication. The alternative — reusing memorable passwords across a hundred accounts — is far riskier.

What is the most common password found in breaches?

The UK National Cyber Security Centre's analysis of breached accounts found 123456 at the top, used by 23.2 million accounts, followed by 123456789 (7.7 million), qwerty (3.8 million) and password (3.6 million). NCSC recommends building passwords from three random but memorable words instead.

Do passkeys make passwords obsolete?

Not yet. Adoption is uneven, account recovery still usually falls back to a password or an email link, and you will hold legacy accounts for years. Treat passkeys as the destination and strong unique passwords plus MFA as the way you stay safe getting there.

Is a weak password really that costly?

For individuals, a compromised account can mean drained funds, identity theft and long-running damage to credit and reputation that affects renting, borrowing and employment. For organisations, credential-driven intrusions lead to data loss, regulatory penalties, operational disruption and stolen intellectual property. Verizon's 2026 Data Breach Investigations Report notes that software vulnerabilities have now overtaken stolen passwords as the leading entry route, at 31% of breaches — which tells you credentials are no longer the single biggest hole, not that they have stopped mattering.

The short version

Make every password long, make every password unique, and let software remember them. Turn on multi-factor authentication for your email account before anything else, and move to passkeys wherever a site offers them. Stop rotating on a calendar and start rotating on evidence. If you take one thing from the 2025 revision of NIST's guidance, take this: a password's security value is dominated by its length and its uniqueness, and nearly every other rule you were taught was a substitute for those two.

The practical starting point is an audit. List the accounts that would hurt most if lost, confirm none of them share a password, generate replacements for any that do with a strong random password generator, and check the survivors against breach data. An afternoon of that work removes most of the risk that a weak password actually carries.