What makes a password strong, and what your policy should require

What changed, and why

The old rule was short-but-complicated: eight characters, upper and lower case, a number, a symbol. It was built for a threat model where an attacker guessed at a login screen. Modern attacks do not do that. They take a stolen database and test billions of candidates offline, or they take a password already leaked from another site and try it against yours.

Against those, length is what helps and symbol-substitution is not. "P@ssw0rd!" satisfies every complexity rule and is in every cracking dictionary. A four-word passphrase nobody has written down before is far harder to break and far easier for a teacher to remember on a Monday.

Forced rotation changed too. Making staff change passwords every ninety days reliably produces Autumn2026!, then Winter2026!, and a sticky note. Current guidance from both the NCSC and NIST is to drop scheduled expiry and change passwords when there is a reason to.

What to put in the policy

• A minimum length rather than a complexity formula — a passphrase of several unrelated words, not a short string with a symbol bolted on.
• Different passwords for school accounts and personal accounts, so a breach at a shopping site does not reach the MIS.
• No shared accounts for anything holding personal data. Where a shared login genuinely cannot be avoided, name it in the policy and say who holds it and how it is changed when somebody leaves.
• Every default password changed before a new device or system goes into use. This is the clause that catches new interactive whiteboards, cameras and network kit.
• Multi-factor authentication on email and on any system holding pupil data, which does more for account security than every password clause combined.
• Change on suspicion of compromise, immediately, with a named person to tell. Not change on a schedule.
• A password manager where the school provides one, and an explicit position on browser-stored passwords where it does not.

Why this belongs in a policy at all

Password rules sent round in an email are advice. The same rules inside an Acceptable Use Policy the Board has adopted, and staff have acknowledged, are a control the school can point at.

That distinction does real work after an incident. If an account is compromised and the school is asked what it required of staff, "we have an adopted Acceptable Use Policy, here is the version in force on that date, and here is who had acknowledged it" is an answer. A circulated email is not.

It matters the other way too. A policy that still demands ninety-day rotation is evidence the school is enforcing a rule that current guidance has dropped — which is exactly the sort of thing a review cycle is meant to catch and most schools have no mechanism to.