Skip to content
Akademia
Book a demo

Secure passwords at work: how to create a strong password and what rules to give employees

How to create a strong password, what length CERT Polska, NASK and NIST recommend, and what to put in a password policy for employees. With a team exercise.

ZeroLayer Team 12 min read

A dark navy office at night with a laptop and phone on the desk, and above them turquoise threads of light joining into a long, orderly chain

How do you create a secure password? Combine several random, unrelated words into a single passphrase at least 14 characters long, because that is the minimum CERT Polska (Poland's national computer emergency response team) recommends today. Every account should have its own password, all of them should be kept in a password manager, and two-step verification should be switched on wherever possible. Below you will find an explanation of why Polish guides quote different numbers, what to put in a company password policy and how to practise it with your team in half an hour.

How to create a strong password step by step

A strong password is one that cannot be guessed or found on a list of breached passwords, yet one you can still remember if you need to. The simplest way to get there is a passphrase made of a few random words.

The UK's NCSC promotes the "three random words" method, and NASK (Poland's national research institute responsible for cybersecurity) wrote in its December 2024 recommendations about a password-sentence of at least five words. Both pieces of advice lead to the same place: length does more than fancy characters. The NCSC also points out that swapping letters for numbers, such as "o" for zero, adds little, because attackers know these tricks and you are more likely to forget such a password.

How to do it in practice:

  1. Pick 4–5 words that have no connection to each other or to you. Opening a book or a dictionary at random pages helps, or you can use the generator in a password manager.
  2. Do not use quotes, song titles, team names, the names of your children or pets, dates or the company name. These are the first things an attacker checks, and some of this information sits on social media.
  3. Join the words into one string. You can separate them with a space or a hyphen, or start each one with a capital letter if that makes it easier to read.
  4. Count the characters. If you get fewer than 14, add another word rather than a digit at the end.

An example of the structure, not a password to copy: [kitchen object] + [weather phenomenon] + [profession] + [plant name]. You choose each word yourself, at random. A password taken from an article, however long, stops being secure the moment it is published.

You only need to know a few passwords by heart: for your computer, your email and your password manager. The manager can generate the rest as random strings you never need to memorise.

Secure password: how many characters?

This is where Polish guides differ, and that is the source of the confusion. The differences come mainly from publication dates: recommendations have moved towards longer passwords over time.

14 characters
minimum password length according to CERT Polska, raised from 12 characters in June 2025
CERT Polska, Technical recommendations for authentication systems
approx. 1 million
most popular breached passwords in the Polish password dictionary published by CERT Polska
CERT Polska, What data breaches tell us about passwords
13%
of known initial access vectors in breaches were credential abuse, the most common vector a year earlier
Verizon, DBIR 2026
SourceMinimum lengthWhat else it recommends
CERT Polska, guide "Look after secure passwords and logins" (Zadbaj o bezpieczne hasła i logowanie)14 charactersseveral words in one password, different passwords for different services, two-step verification, change only when a leak is suspected
CERT Polska, technical recommendations for administrators (updated June 2025)14 charactersallow at least 64 characters, no requirement for special characters or digits, no forced periodic change, block passwords from lists of popular passwords
NASK, news item of 2 October 202614 characterslength matters more than complexity, a separate password for each account, password manager, 2FA
NASK, news item of 31 December 202412 charactersa password-sentence of at least 5 words, special characters and digits do not increase security, no periodic change
gov.pl, Knowledge Base "How to create a secure password"8 characters, preferably 12 or 14material based on NCSC advice, recommends three random words but also mixing four character groups
NIST SP 800-63B-4 (July 2025)15 characters when the password is the only safeguard; 8 when it is part of MFAban on complexity rules, ban on periodic change without evidence of compromise, checking passwords against a list of compromised ones

What does this mean for a company? Adopt 14 characters as the minimum, because that is what both CERT Polska and NASK recommend today. If a system allows login with a password alone, without a second factor, the US NIST goes a step further and requires 15 characters. Older materials quoting 8 or 12 characters are not wrong in intent; they have simply been overtaken.

Why one password for many accounts is the biggest problem

Even a very long password achieves nothing if the same password works for your work email, an online shop and a food delivery app. When the database of one of these services leaks, criminals automatically try the same username and password pair in hundreds of other places. This attack is called credential stuffing.

CERT Polska puts it plainly: if someone used the same or a similar password on another service whose passwords leaked, an attacker can easily prepare a short list of passwords to try. What happens to passwords after a leak and how administrators defend against it is described in our article on credential stuffing. The second route for leaks is malware that steals passwords from the browser, which we cover in how an infostealer works.

For an employee the conclusion is simple: the password for a work account never ends up anywhere else, not even in a slightly altered version with a different digit at the end.

Password manager at work

Dozens of unique, long passwords are too much for human memory, so you need a tool. NASK describes a password manager as a place that stores login details and generates strong passwords, while you remember only one master password. CERT Polska adds that managers built into browsers and phones also work well.

In a company it is better if the choice is not left to each person. The IT department names one tool, and employees know where to keep work passwords. Agree on a few rules:

  • The master password for the manager is the longest passphrase you know, and the only password you do not write down anywhere else.
  • The manager must be protected by a second login factor. We write more about the types of second factor in our article on two-step verification.
  • Shared accounts, such as the company's social media profile, are shared through the manager, not by email, chat or on a sticky note.
  • Work passwords do not end up in a private password manager or in the browser on a private computer.

In our article on cyber hygiene at work we suggest a 20-minute workshop on installing a password manager. This article goes a step further: the point is that the workshop leaves behind written rules, not just an installed app.

Should you change passwords every 30 or 90 days?

No, not without a reason. A forced change every month or every quarter was the standard for years, but today all three main sources advise against it.

NIST SP 800-63B-4 explicitly prohibits requiring periodic password changes and requires a change only when there is evidence that the password has been compromised. CERT Polska, in its recommendations for administrators, writes that a system should not force periodic changes. NASK, in its December 2024 recommendations, explains why: frequent changes lead to ever simpler passwords. In practice this means "Spring2026" turns into "Summer2026".

You change a password immediately in three situations: when you suspect someone knows it, when a service has notified you of a leak, or when you typed it into a page that turned out to be fake.

Password policy for employees: what to include

A password policy does not need to be ten pages long. An employee should be able to read it in five minutes, and an administrator should be able to implement it without guessing what it means. Whatever systems you use, it is worth including these points:

  • Length: a minimum of 14 characters for employee passwords, and the option to set a password of at least 64 characters.
  • Complexity: no requirement to use digits, capital letters or special characters. Encourage passwords made of several words.
  • Blocking weak passwords: the system rejects passwords from lists of popular and breached passwords. For this purpose CERT Polska provides a Polish dictionary of about a million of the most common breached passwords. Add the name of your company and its products to the list.
  • Password changes: no forced periodic change, mandatory change when a leak is suspected.
  • Uniqueness: a ban on using a work password on any other service.
  • Storage: one company password manager, a ban on keeping passwords in files, notes or on sticky notes by the monitor. The system allows pasting passwords so the manager can work.
  • MFA: mandatory for email, remote access, cloud systems and the password manager.
  • Sharing: nobody, including "the IT department" on the phone, asks for your password. Shared accounts only through the manager.
  • Leaks: who to report a suspicion to, how, and within what time.

The last point is the one most often left out, and it decides whether an employee reports a problem within an hour or after a week.

What to do when a password has leaked

An employee does not need to understand how the market for stolen data works. They need to know the order of steps:

  1. Change the password for the affected account and for every other account where the same or a similar password works.
  2. Turn on two-step verification if you do not have it yet. CERT Polska collects instructions for popular services at cert.pl/2etapy.
  3. Report it within the company, even if the leak concerns a private account and the password was similar to your work one. The IT team will check whether anyone has tried to log in.
  4. If fraud or an attack has occurred, the incident can be reported to CERT Polska via incydent.cert.pl.

There are services where you can check whether your email address has appeared in known breaches, but they cover only part of the publicly available databases. A company that wants to know about leaks of employee login details before criminals make use of them needs continuous monitoring. We write about this in our article on data leak monitoring.

Remember too that a password often leaks not from a service's database but straight from an employee: through a fake login page or a call from a supposed consultant. We explain how such manipulation works in our article on social engineering.

How to practise secure passwords with your team

Rules do not take hold on their own. One 30-minute meeting split into three parts is enough.

PartTimeWhat you do
Myth or fact10 minYou read out five statements, such as "A password must be changed every 90 days" or "A special character at the end makes a password secure". The team votes, and you explain using the table in this article.
Building a passphrase10 minEveryone puts together their own passphrase from four or five random words and counts the characters. Nobody shows the result; only the method matters.
Tidying up10 minEveryone moves three work accounts into the company password manager and checks whether any of them uses a password they also use on a private service.

After the meeting, send the team a one-page password policy. A month later, ask two questions in a short quiz: how many characters a password should have, and what you do when a service reports a leak. You can also run a quick knowledge check with our quiz.

How it works in Akademia ZeroLayer

Akademia ZeroLayer teaches habits; it does not manage passwords. It does not check employees' passwords or monitor leaks, which is the job of the IT department and technical tools. It deals with the human side. Passwords and logging in are covered in video microlessons, games and quizzes, and phishing simulations show in practice what a fake login page looks like, which is where passwords most often end up in criminals' hands.

New employees cover the basics in an onboarding path, and role-based paths let you add more content for people with access to administrative systems. Automatic reminders keep track of deadlines, every participant receives a numbered certificate, and the manager dashboard shows team progress and generates training reports. You will find the list of topics in the training topics section, and the option of a free 30-day pilot for one department in the Options section.

FAQ

How do I create a secure password that is easy to remember?

Combine four or five random, unrelated words into one passphrase at least 14 characters long. Avoid quotes, names, dates and the company name, and remember that swapping letters for digits adds little. You will remember such a password more easily than a short string of special characters, and the rest of your passwords can be generated and stored by a password manager.

How many characters should a strong password have?

CERT Polska and NASK now recommend at least 14 characters. Older materials mention 8 or 12 characters because they were written earlier: CERT Polska raised its minimum from 12 to 14 characters in June 2025. The US NIST requires 15 characters when the password is the only safeguard for an account.

Does a password have to contain special characters and digits?

No. In its recommendations for administrators, CERT Polska advises against requiring special characters, digits and capital letters, and NIST prohibits such complexity rules. Length matters more than complexity, so it is better to add another word than an exclamation mark at the end.

How often should passwords be changed at work?

Only when there is a reason: a suspicion that someone knows the password, a notification of a leak, or having typed the password into a fake page. CERT Polska, NASK and NIST advise against forcing periodic changes every 30 or 90 days, because this leads to predictable, ever simpler passwords.

Is a password manager safe?

CERT Polska and NASK recommend password managers because they let you have a separate, long password for every account. The condition is a strong master password and two-step verification switched on for the manager itself. In a company it works best when the IT department names one tool for all employees.

Sources

Read next