Securing Our Digital Lives: A Pledge on World Password Day

World Password Day, observed on the first Thursday of May, is a good reminder that most account takeovers still start with weak, reused or phished passwords. The advice has also changed in recent years: long unique passwords, a password manager, multi-factor authentication and passkeys now matter more than frequent forced changes. Here is a practical pledge for individuals and teams. Reviewed October 2026.

The short answer: use a password manager, make every password unique and long, turn on multi-factor authentication (preferably an authenticator app, security key or passkey), switch to passkeys where offered, and stay alert to phishing. Read how scammers misuse brand names in our alert on fraudulent activities.

Why passwords still matter

Attackers rarely “hack” a password by guessing it live. They reuse passwords leaked in earlier breaches (credential stuffing), trick people into entering them on fake sites (phishing), or infect devices with malware that steals saved logins. That is why a unique password per account, plus a second factor, blocks most of these attacks.

The 8-point password pledge

Should you change passwords regularly?

Older advice told people to change passwords every few weeks or months. Current guidance from bodies such as NIST recommends against forced periodic changes, because they push people toward weak, predictable variations. Change a password when there is a reason: it appeared in a breach, you shared it, you suspect malware, or an employee with access has left. Otherwise, a long unique password plus MFA is stronger.

Check whether your accounts were exposed

Use a trusted breach-notification service such as Have I Been Pwned to see if your email appeared in known breaches, and change passwords for affected accounts. Many password managers and browsers also warn about reused or leaked passwords.

For businesses and teams

• Enforce MFA on email, cloud, CMS, hosting, ad platforms and social accounts. Business email is the key to everything else.
• Use a team password manager instead of spreadsheets or chat messages.
• Apply least privilege: give people only the access they need, and review it quarterly.
• Offboard promptly: remove access and rotate shared credentials when someone leaves.
• Train staff to spot phishing, fake job offers and invoice scams.
• Protect your website: see our WordPress security checklist.

A simple 15-minute password check-up

1. Install a password manager and import saved passwords.
2. Change the password on your primary email and banking accounts first, using long unique ones.
3. Enable MFA on email, banking, social media and work accounts.
4. Delete old accounts you no longer use.
5. Set up account recovery options and store recovery codes safely.

Conclusion

Good password habits are among the cheapest and most effective security measures. Take the pledge today: manager, unique long passwords, MFA, passkeys and healthy suspicion of unexpected messages. For help securing your website or applications, contact The Adroit.

Talk to our team

FAQs

When is World Password Day?

It is observed on the first Thursday of May each year.

What makes a strong password?

Length and uniqueness. A passphrase or generated password of 12 or more characters, used on only one account, is far stronger than a short complex one.

Do I need to change passwords every few months?

Not unless there is a reason, such as a breach or suspected compromise. Current guidance favours unique long passwords with MFA over routine forced changes.

Are password managers safe?

Reputable password managers with a strong master password and MFA are much safer than reusing passwords or storing them in notes.

What is a passkey?

A phishing-resistant login method that uses your device’s biometrics or PIN instead of a typed password, supported by a growing number of services.

Is SMS-based MFA enough?

It is better than nothing but weaker than authenticator apps, security keys or passkeys, because SMS can be intercepted or SIM-swapped.

What should I do if my password is leaked?

Change it immediately, change any account where you reused it, enable MFA and watch for suspicious activity.