February 1: Change Your Password Day

Edward Johnson, hi-tech and engineering expert, February 1, 2026

Why does a Change Your Password Day exist?

Created in 2012 by Gizmodo and Intel Security, Change Your Password Day exists to raise awareness of the dangers of weak and reused passwords. In 2013, the Yahoo hack compromised 3 billion accounts, exposing names, dates of birth and security questions. In 2012, the attack on LinkedIn saw 167 million credentials put up for sale on the dark web. In 2021, a single weak password allowed hackers to penetrate the Colonial Pipeline system, causing a fuel shortage in the United States. In France, data breaches have affected hospitals, such as the one in Dax in 2021, paralyzed by ransomware because of a poorly protected account.

How to create a secure password that's easy to remember

One effective approach is passphrases, recommended by ANSSI and the NSA. For example, instead of a complex password like Tr0ub4dor&3 (hard to remember and vulnerable to brute-force attacks), you can use a phrase like TheDogEatsAPizzaIn2024!. It's long, easy to memorize and harder to crack. Another method is to use the first letters of a personal sentence: I love drinking my black coffee every morning at 7am becomes IldmbcE7am!. To manage several accounts without forgetting passwords, managers like Bitwarden, Dashlane or 1Password can store and generate unique credentials. Google and Apple also encourage the use of physical security keys like the YubiKey, or biometric systems like Face ID and Windows Hello. A good practice is also to never reuse the same password: in 2019, 21 million users fell victim to the Canva hack because they used the same password across multiple sites.

Mistakes to avoid when choosing a password

One of the most common mistakes is using a password that is too simple or predictable. Every year, rankings reveal that millions of users still choose 123456, password or qwerty. Another mistake is reusing the same password across multiple sites. For example, the 2012 LinkedIn hack allowed attackers to test the same credentials on Gmail, Facebook and other services. Hackers use techniques such as credential stuffing, automatically testing millions of stolen combinations on other platforms. Another common mistake is relying on too obvious a substitution, like turning password into P@ssw0rd. Tools such as Hashcat can test these variations in a matter of minutes. Finally, storing passwords in an unsecured file, such as a text document on your computer titled passwords.txt, is an open door to attacks.

Should you change your passwords regularly?

Regularly changing passwords was long a standard recommendation, but today, cybersecurity experts such as NIST (National Institute of Standards and Technology) and ANSSI advise against frequent changes imposed without reason. However, it is essential to change a password if a leak is detected. Services such as Have I Been Pwned let you check whether your password has been leaked.

Two-factor authentication

Two-factor authentication (2FA) is essential against the hacking of online accounts. Unlike a simple password, which can be stolen through phishing or a data breach, 2FA requires a second verification step. For example, during the massive 2020 attack on Twitter, in which hackers compromised the accounts of figures such as Elon Musk and Barack Obama, users protected by two-factor authentication remained out of reach of the cybercriminals. Google also demonstrated the effectiveness of 2FA: in 2018, after requiring its employees to use YubiKey security keys, the company reduced intrusions to zero. There are several 2FA methods: the most common relies on temporary codes sent by SMS or generated via apps like Google Authenticator or Microsoft Authenticator. The safest methods include biometric authentication (Face ID, fingerprint) and physical keys such as YubiKey and Google Titan.