Headlines about "billions of passwords leaked" appear every few months. They are alarming, but they can also be confusing: is your password in there, should you change everything, and does any of it actually matter if you already use a "complicated" password?

The good news is that the advice from the people who write the rules has become simpler, not harder. This guide translates the latest official guidance, from the US National Institute of Standards and Technology (NIST) and the UK's National Cyber Security Centre (NCSC), into a few habits that work for everyday people.

Why leaks keep getting bigger

Large leak headlines often do not describe one company being hacked. Many describe compilations: collections of credentials gathered over years from earlier breaches and from malware on people's computers, then put together and shared. Reporting on these collections varies, and the headline number usually counts records, not unique people, so it is hard to say how many are new or still valid.

What matters for you is simpler. The free service Have I Been Pwned, which lets you check whether your email address appears in known breaches, listed more than 17.8 billion breached accounts from over 1,000 websites when we checked on 21 October 2026. With numbers like that, it is safest to assume that at least one old password of yours has leaked somewhere.

The real danger is not the leak itself but password reuse. If the same password protects your email, your bank and an old forum, a leak from the forum hands criminals the key to everything else. They try leaked email-and-password pairs on many sites automatically.

What the official guidance now says

NIST published the final version of its digital identity guidelines, SP 800-63B-4, in July 2025. It is written for organisations that run login systems, but it tells you a lot about what really protects an account:

  • Length beats complexity. A password used on its own should be at least 15 characters. Services should accept at least 64 characters, so long passphrases fit.
  • No forced mixtures. Services shall not require "one uppercase, one number, one symbol" style rules. These rules tend to produce predictable passwords like "Summer2026!".
  • No routine expiry. Services shall not force you to change passwords on a schedule, but they must force a change when there is evidence a password has been compromised.
  • Blocklists. Services must check new passwords against a list of common, expected or already compromised passwords.
  • Password managers are welcome. Services shall allow password managers and autofill, and should allow pasting.
  • No hints or security questions when you choose a password.

The NCSC says something similar in plainer words: combine three random words to create a password that is long enough and strong enough, for example three unrelated words you can picture together. It also encourages using a password manager.

Five habits that actually help

1. One password per account

This is the single most important habit. Unique passwords turn a leak at one site into a problem for one site only.

2. Make it long

Use either three or more random words, or a long random string from a generator. Our password generator creates random passwords in your browser using cryptographic randomness, and the page never sends the password over the network. Length matters more than adding symbols.

3. Let a password manager remember them

Nobody can remember dozens of unique passwords. A password manager stores them, fills them in for you, and can generate new ones. Protect the manager itself with a long passphrase you don't use anywhere else, and turn on two-step verification for it if offered.

4. Give your email the strongest protection

The NCSC recommends a strong and separate password for your email, because whoever controls your email can reset the passwords of most of your other accounts. Treat it as your master key.

5. Turn on 2-step verification

Two-step verification (2SV, also called two-factor authentication) asks for a second proof, such as a code from an app or a prompt on your phone. According to the NCSC, it will prevent a criminal from accessing your email account even if they know your password. Turn it on first for email, then for banking, social media and shopping accounts.

How to check if you were affected

  • Check your email address on Have I Been Pwned. It shows which known breaches included it and what kind of data leaked.
  • Use your password manager's checks. Many managers warn about reused, weak or leaked passwords.
  • Watch for signs: login alerts you don't recognise, password reset emails you didn't request, or messages your friends say you sent.

A result on a breach list does not mean someone is in your account right now. It means that password should be treated as public.

What to do after a leak

  1. Change the leaked password on that site, and on every other site where you used the same or a similar one.
  2. Start with email, then financial accounts, then everything else.
  3. Turn on 2-step verification while you are there.
  4. Sign out other sessions if the service offers it, and review recovery options (backup email, phone number).
  5. Be careful with follow-up messages. Leaks are often followed by phishing emails that mention the breach to seem credible. Go to the site directly instead of clicking links.

You don't need to change healthy, unique passwords just because a big headline appeared. NIST's guidance is clear that routine changes are not the goal; changing on evidence of compromise is.

Where a VPN fits, and where it doesn't

A VPN protects your connection, for example on public Wi-Fi, where it hides which sites you visit from the network operator. It does not protect a password that has already leaked, and it cannot stop someone from logging in with it. Strong, unique passwords and 2-step verification protect your accounts; a VPN such as VPNRice protects the path your data travels. For the network side, see our public Wi-Fi safety guide.

Key takeaways

  • Assume old passwords have leaked; reuse is the real risk.
  • Use long passwords: three random words or a generated string of 15 characters or more.
  • Keep them in a password manager.
  • Give your email a separate, strong password and 2-step verification.
  • Check Have I Been Pwned, and change passwords when there is evidence of a leak, not on a timer.