Your password strength doesn't matter, says a Microsoft security expert. Not the length, not the complexity, not how many special characters it uses. Hackers can get it anyway, and the only thing that truly makes a difference, he says, is whether you have two-factor authentication (2FA) turned on.

Are complex passwords really necessary?

They need to be long and complex because it's their length, complexity and uniqueness that determines how difficult they are to crack. Passwords are the keys to the IT castle and it doesn't matter how strong your walls are if the lock on the door is easily picked.

How complex should passwords be?

Complex passwords should contain a good mixture of upper/lower case letters, numbers, and symbols. Passwords should also not be based on dictionary words and should contain at least seven characters (the longer the better).