Free tools Windows power users keep installed
One-click scans. No signup required.
Four pieces of familiar security advice now need correction: changing every password on a calendar, forcing arbitrary mixes of letters and symbols, treating antivirus as obsolete, and making absolute claims about public Wi‑Fi. The safer approach is evidence-driven: use long, unique credentials; change them when compromise is suspected; add phishing-resistant multifactor authentication; keep protective software and systems patched; and treat VPNs as a risk-reduction tool rather than a guarantee.
The title does not identify one canonical list, so the selection below focuses on four corrections supported by current National Institute of Standards and Technology (NIST) and Cybersecurity and Infrastructure Security Agency (CISA) guidance.
As an Amazon Associate I earn from qualifying purchases.
1. “Change every password every 30, 60 or 90 days”
Why the calendar rule is outdated
Scheduled password changes sound cautious, but they can produce predictable variations: a user changes one character, increments a number or reuses a familiar pattern. CISA’s 2023 red-team guidance warns that regular changes to memorized passwords can lead to these patterns. A forced change also creates a heavy workload for people managing many accounts, increasing the temptation to reuse credentials.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
NIST SP 800-63B-4 is explicit under its password-verifier requirements: “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.” The standard instead calls for a change when there is evidence that the authenticator has been compromised.
#1 Best Overall
When you should change a password
Change a credential promptly when a service reports a breach, when you find it in a breach-notification service, when a phishing page may have captured it, when an untrusted person has had access to it, or when malware may have recorded it. Change it as well if you discover reuse on another service, because compromise of one site can expose the same password elsewhere.
A better password routine
- Use a password manager. Let it generate a different random password for every account and store it in an encrypted vault.
- Protect the manager itself. Give the vault a long, unique passphrase and enable the strongest multifactor option the manager supports.
- Prioritize important accounts. Start with email, financial services, cloud storage, mobile-carrier accounts and the account used to recover other passwords.
- Respond to evidence, not the calendar. Reset only the affected credential and any other account where the same secret was reused. Sign out other sessions if the service offers that control.
- Turn on multifactor authentication. A password remains vulnerable to phishing; a second factor can limit the damage, and a phishing-resistant method is preferable where available.
This approach replaces a recurring chore with monitoring and targeted response. You still change passwords when there is a reason; you simply stop treating an arbitrary date as evidence of compromise.
2. “A strong password must contain uppercase letters, numbers and symbols”
Why composition checklists miss the point
Rules that demand one uppercase letter, one digit and one symbol measure whether a format was followed, not whether the resulting secret is difficult to guess. They often encourage predictable substitutions, such as changing “password” to “Password1!”. NIST SP 800-63B-4 prohibits verifiers from imposing additional composition rules, including mandatory mixtures of character types.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteLength, unpredictability and uniqueness matter more. A long passphrase made from unrelated words can be easier to type and remember than a short string built around a forced symbol. A randomly generated password from a manager is stronger still because it does not depend on human choices.
Rank #3
NIST’s minimum lengths, by use
| Use case | NIST SP 800-63B-4 minimum | How to apply it |
|---|---|---|
| Password used as the only factor | At least 15 characters | Prefer a manager-generated random value or a long, unique passphrase. |
| Password used only as part of multifactor authentication | At least 8 characters | Use a longer value when the service permits it; never reuse it elsewhere. |
| Composition requirements | No mandatory character-type mixture | Do not add predictable rules merely to satisfy an uppercase, number or symbol checklist. |
These are requirements for digital identity services and credential service providers, not a promise that every website has implemented the same limits. A site may set a longer maximum, reject known-compromised passwords or offer passkeys instead. Follow the service’s current controls while keeping your own standard higher whenever possible.
What to do when a site still demands complexity
- Meet the site’s minimum without inventing a personal pattern you will repeat elsewhere.
- Use the longest limit the service accepts, unless a password manager reports that the value is truncated or mishandled.
- Generate a unique value for that service; do not append the same “!” or year to a password used on another account.
- Check whether the account supports a phishing-resistant sign-in method and enable it alongside the password.
3. “Antivirus is obsolete if you keep your software updated”
Why deleting antivirus creates a gap
Modern security is layered, but that does not make antivirus or antimalware unnecessary. In an August 2025 fact sheet for state, local, tribal and territorial governments, CISA tells organizations to confirm that networks are protected by antivirus or antimalware software and to prioritize updates for those tools. The guidance treats endpoint protection as one control among several, not as a complete defense.
CISA’s June 2025 exposure guidance likewise emphasizes prompt patching, replacing unsupported software and devices, multifactor authentication where possible, monitoring and routine assessment. An up-to-date endpoint tool cannot compensate for an unpatched browser, an unsupported operating system or a stolen password.
Build a layered baseline
| Layer | Action | What it does not replace |
|---|---|---|
| Endpoint protection | Keep the operating system’s built-in protection or a reputable antimalware product enabled and updated. | It does not replace patches, safe account practices or backups. |
| Software and device support | Install security updates promptly and replace products that no longer receive fixes. | It does not detect every malicious file or stop a user from giving away credentials. |
| Account security | Use unique passwords, a password manager and multifactor authentication, preferably a phishing-resistant method. | It does not remove malware already present on a device. |
| Exposure management | For organizations, prioritize urgent fixes identified in CISA’s Known Exploited Vulnerabilities Catalog and assess internet-facing systems regularly. | It is not a substitute for endpoint controls or incident response. |
| Recovery | Maintain tested backups and know how to restore a clean device or account. | A backup cannot prevent an initial infection. |
The cited CISA documents are written for government and organizational environments. For a home computer, the practical lesson is narrower: do not disable built-in protection on the assumption that updates alone are enough, and do not mistake antivirus for a guarantee that every attack will be blocked.
Best Value
When antivirus alerts appear
- Stop interacting with the suspicious file, browser page or message.
- Allow the security tool to quarantine the item and install any pending definition or engine update.
- Change credentials from a separate, trusted device if you entered them while the alert or suspected infection was active.
- Install operating-system and application patches, then run the tool’s recommended full scan.
- If the device remains unstable or the alert returns, disconnect it from sensitive networks and use the vendor’s recovery or professional support process rather than repeatedly dismissing warnings.
4. “Public Wi‑Fi is either completely safe with a VPN or always unsafe”
Why both absolutes fail
A public network can expose traffic to risks such as masquerading and network sniffing, but the danger depends on what you are doing, which protections your device and services use, and whether the network itself is legitimate. A VPN encrypts the connection between your device and the VPN endpoint; it does not make a fake hotspot genuine, repair a compromised device or protect an account after you surrender its password to a phishing site.
CISA’s 2024 federal mobile workplace guide tells personnel using third-party networks to use an agency-authorized VPN or another authorized secure-access solution and to activate the session after connecting. The same guide warns that vulnerabilities can remain even when a VPN is in use. That is workplace guidance for authorized devices and sensitive work, not a universal consumer promise that every public hotspot is safe once a VPN icon appears.
Choose the response to the situation
| Situation | Safer practice | Remaining limitation |
|---|---|---|
| Routine browsing on a personal device | Use HTTPS sites, keep the device patched, disable automatic joining of unknown networks and avoid entering sensitive credentials on an unfamiliar hotspot. | HTTPS and device security do not prove the hotspot is legitimate. |
| Sensitive work on an employer-managed device | Connect only through the organization’s approved VPN or secure-access solution and activate it after joining the network, as directed by policy. | The VPN does not remove every network or endpoint vulnerability. |
| Financial, administrative or account-recovery task | Prefer a trusted home network or cellular connection. If you must use third-party Wi‑Fi, verify the network name through an independent source and use the organization’s authorized secure-access method. | A secure tunnel cannot rescue a phished login or an infected device. |
| Unexpected captive portal or certificate warning | Cancel the connection and seek another network rather than bypassing the warning. | Convenience is not a reason to override a security control. |
Public Wi‑Fi checklist
- Turn off auto-join for open networks and forget networks you no longer trust.
- Confirm the exact network name with staff or an official notice; names can be imitated.
- Use the organization’s authorized VPN or secure-access solution for work data, and verify that it is actually connected.
- Keep the operating system, browser and security tools current before traveling.
- Use multifactor authentication so a stolen password alone is less useful.
- Disconnect when finished and remove the network from the device’s saved list if it was temporary.
How the four corrections fit together
These updates are not four isolated product recommendations. They form a sequence: make credentials difficult to guess and impossible to reuse, add an authentication factor that resists phishing, maintain the device’s protective and patching layers, and treat network access as a context-dependent risk.
Compare authentication choices before enabling one
| Authentication choice | Phishing resistance | Service compatibility | Recovery if a device is lost | Regular-use experience |
|---|---|---|---|---|
| Password alone | Not phishing-resistant, according to NIST. | Broad, because nearly every service supports passwords. | Usually relies on the service’s account-recovery process. | Familiar, but requires careful manager use and vigilance. |
| Password plus a multifactor method | Depends on the method; a password itself remains phishable. | Varies by service and by the factors it offers. | Requires a documented backup factor or recovery route. | Usually adds a prompt or code to sign-in. |
| Hardware-based FIDO token | CISA identifies hardware FIDO tokens as a strong phishing-resistant option; NIST requires phishing-resistant authentication at AAL3. | Only works where the account supports the relevant FIDO/WebAuthn method. | Plan a spare token or another approved recovery method before losing the primary device. | Quick after setup, but you must have the token available. |
NIST SP 800-63B-4 requires AAL2 verifiers to offer at least one phishing-resistant option and requires phishing-resistant authentication at AAL3. Those assurance levels apply to the services implementing them; they do not mean every consumer website offers a hardware key. Open the security settings for your most important accounts and check which methods are supported before buying or enrolling anything.
Quick Recap
Common mistakes after adopting the updated advice
- Replacing calendar changes with no review at all: watch breach notices and account alerts so evidence of compromise still triggers an immediate reset.
- Keeping one “base password”: uniqueness matters even when every version has different punctuation.
- Enrolling one security key with no recovery plan: add a spare key or follow the service’s documented backup process while you still have access.
- Disabling protection to solve a false positive: update the tool and investigate the file instead of leaving the device unprotected.
- Assuming the VPN icon means anonymity or safety: continue checking the network, device and account risks that the tunnel cannot address.
- Ignoring unsupported software: a familiar device that no longer receives security fixes is an exposure that antivirus cannot fully close.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
