The core advice: match the credential to the job
Yee's recommendations break down by situation:
- Use a passkey where one is offered. She calls it the simplest and most secure option. Nothing needs memorizing, it can't be reused, and it has two-factor elements built in.
- Use a password manager for everything else. Where a site has no passkey support, she wants a long, random, unique password that the manager generates and stores. A 32-character password costs you no more effort than an 8-character one.
- Memorize a few secrets. She says to memorize at least two passwords: one for the password manager and one for your email account. The point is to avoid being locked out of email or banking if you lose access to the manager.
- Make memorized secrets passphrases. She used to suggest passphrases and "pseudo-random" tricks about equally. An example of the tricks is taking the second letter of each line of a song and adding numbers and symbols. She now leans clearly toward passphrases, and longer is better. A random mix of words earns "bonus points."
The "at minimum two" figure is her own recommendation. It isn't a formal standard.
What changed her mind: the cracking numbers
Yee points to Hive Systems, a cybersecurity firm that publishes an annual table of password-cracking times against consumer-grade hardware. Her figures for an 8-character password, against a fleet of 16 RTX 5090 graphics cards:
| Character mix | Estimated time to crack |
|---|---|
| Upper and lowercase letters only | 12 years |
| Plus numbers | 50 years |
| Plus special characters | 132 years |
Hive Systems' own release confirms the 132-year figure. The times are calculated against a rented 16x RTX 5090 GPU fleet running bcrypt at a work factor of 10. The same release says the time to brute-force a random eight-character password using the full mix of characters fell from 225 years in 2024 to 164 in 2025 to 132 in 2026. That is roughly 20 to 25% per year.
This is not a reason to relax. The trend is moving the wrong way, and Hive says length remains the single best defense, since every character added multiplies the time required far more than swapping in a symbol or two.
Read the chart carefully
The table is a model, not a prediction for your account. Four caveats apply:
- It assumes an offline attack. The attacker already holds a stolen database of password hashes. Live login pages rate-limit guesses.
- It assumes a specific hash. The table uses bcrypt at cost 10. Sites that store passwords with weaker hashing can fall much faster.
- It assumes a random password. Yee's own caveat is that anything leaked in a breach, reused across sites, or built from dictionary words is cracked almost instantly.
- It reflects one year's hardware. Hive describes the rig as a rented 16x RTX 5090 fleet running against bcrypt, about 24% faster than last year.
Yee's practical conclusion is that a password you can actually remember beats a perfect one you will forget. This holds especially if two-factor authentication backs it up. She also says that if you choose a passphrase of more than four words, you may not have to trade length against strength.
Why this fits current standards
NIST's final SP 800-63B Revision 4 digital identity guidelines point the same way. They treat passwords and passphrases together. A password used as the only authentication factor needs a minimum of 15 characters. A password used only as part of multifactor authentication can be as short as eight. Services should allow at least 64 characters and should block commonly used or compromised passwords. They must not impose arbitrary composition rules or force periodic changes.
These rules apply to the services that check passwords. They don't guarantee that your particular passphrase is strong.
NIST also stresses using a distinct password for each service. Reuse is what enables credential-stuffing attacks, where a password stolen from one site is tried on others. The guidance supports password managers too.
A passphrase has to be unpredictable
Several words strung together are not automatically strong. A famous quote, a lyric or a proverb is still guessable, and attackers try those early. PCWorld's earlier explainer on cracking makes a related point. Crackers use dictionaries, masks and rules that exploit predictable human habits. Examples are a capital letter first, digits at the end, or a common word plus a number. A passphrase of genuinely unrelated words avoids those patterns. Yee gives no word-count recipe beyond "more than four," so treat that as her guideline and not a formal threshold.
Why passkeys come first
Microsoft's documentation explains the mechanics. When you register with a service, your device generates a key pair. The private key stays on the device in Microsoft's description of the FIDO design, and the service stores only the public key. Windows Hello biometrics or a PIN unlock the private key. Microsoft's support FAQ says passkeys are phishing-resistant because each one is bound to a specific domain. A passkey made for one site can't be presented to a lookalike site.
A few practical points for Windows users:
- Where they live. Microsoft's documentation says Windows 11 22H2 with KB5030310 added a native passkey management experience. Passkeys can be used on all supported Windows client versions.
- Privacy consent. Starting in Windows 11 24H2, apps must get your consent before accessing passkeys. You can change this under Settings > Privacy & security > Passkey access.
- Syncing. Microsoft's FAQ says synced passkeys can be used through Microsoft Password Manager or a third-party provider. Cross-device sign-in uses a QR code and a proximity check.
- Enterprise caveat. Microsoft's Entra guidance says Entra passkeys on Windows are device-bound and don't sync. Each device needs separate registration for each Entra account.
Don't skip recovery planning
Microsoft's Entra deployment guidance says users should have at least two authentication methods registered, in case a device is lost or stolen. That guidance is for enterprise deployments, not a universal consumer rule. It still supports Yee's logic: protect the manager and your email, and keep a working way back into both.
A short checklist
- Turn on passkeys wherever a site offers them, and confirm you have a recovery path.
- Use your password manager to generate long, unique passwords for sites without passkeys.
- Memorize at least your manager's master password and your email password. Make each a long passphrase of unrelated words.
- Avoid quotes, lyrics, and anything a stranger could guess about you.
- Add two-factor authentication wherever you can.
- Remove apps and browser extensions you no longer use. That was Yee's tip of the week, because legitimate software can turn bad if its developer sells it or is hacked.
Bottom line
The advice is less contradictory than it sounds. Let machines handle the strong, random, unique secrets. Keep your own memory for the few that must live in your head. Make those long and unpredictable, and back them with a second factor.