CISA advises passwords that are long, random and unique: at least 16 characters, a different one for every account, and a password manager to keep track. For accounts where length rules are enforced by policy, its ransomware guide sets a floor of 15 characters. Both point the same way.
The two figures
CISA's consumer guidance says "at least 16 characters, longer is stronger." Its ransomware guide asks for unique passwords of at least 15 characters for organizations. Pick 16 and you satisfy both.
CISA also says you can use a random mix of upper and lower case letters, numbers and symbols, or a passphrase of four to seven unrelated words. The key words are random and unrelated. A favorite quote or a pet's name is not.
A one page policy
- Every account has its own password. No reuse.
- At least 16 characters, or a passphrase of four to seven unrelated words.
- Store them in a password manager. Browser built-in managers are free and are better than memory or a spreadsheet.
- Turn on multi-factor authentication wherever it is offered.
- Admins use a separate admin account from their daily one.
- Lock accounts after repeated failed sign-ins where the system allows it.
What to stop doing
Calendar-based forced changes tend to push people toward predictable patterns. Check your framework, insurer or funder for any rule that requires them, and otherwise change a password whenever you suspect it is exposed.
Sharing passwords by text or email leaves copies in places you do not control.
Sticky notes on monitors in a shared office are a real exposure. A manager is better.
Shared accounts
Many small organizations share a social media login or a donation platform login. A password manager that supports sharing lets you grant and remove access without changing the password each time someone leaves. Ask whether the tool offers a team feature before you buy.
When someone leaves
Remove them from shared vaults, rotate any password they knew for a shared account, and check that their personal devices no longer have saved sessions. See how to offboard volunteers and staff.
Quick check
Do I need a paid password manager?
Not necessarily. CISA notes some are free, such as those built into web browsers, and others are paid. Choose based on sharing and admin features you need.
Sources
Last reviewed: 19 October 2026.
