Canadians are carrying childhood passwords into adulthood, and Gen Z may be the most reluctant to change

Canadians have actually welcomed electronic banking, shopping, streaming, social networks and cloud-based working, yet an extremely old piece of innovation continues to sit in between lots of people and their digital lives: the password. Research study launched by NordPass shows that passwords can stay in usage for several years, or perhaps years. Some stemmed when their users were substantially more youthful, indicating qualifications created for reasonably irrelevant early online activities might consequently be utilized in a the adult years including banking, work and other important accounts.

The research study provides an especially fascinating finding for a technology-literate society such as Canada. Generation Z became the age most hesitant to alter passwords, regardless of being carefully connected with digital innovation. This recommends that digital familiarity ought to not be puzzled with cybersecurity awareness.

Passwords age with their owners

The NordPass research study included 7,861 individuals aged in between 18 and 74 throughout Canada, Australia, France, Germany, Italy, Spain, the UK and United States. The study on password-storage practices was performed by Nord Security in between 26 March and 6 April 2026. Internationally, 54 percent of those surveyed stated that they had actually altered their longest-standing password throughout the previous 12 months.

That leaves a significant group whose earliest qualifications have actually continued for longer. The research study provided to Digital Journal shows that around 15 percent had actually altered their longest-standing password within 3 years and 8 percent 3 to 5 years formerly. 4 percent were still utilizing qualifications developed 5 to 10 years previously, while approximately 3 percent had passwords more than a years old. Around 6 percent stated they had actually never ever altered their earliest password.

There were noticable nationwide distinctions. Italy tape-recorded the greatest percentage of current password modifications at 65 percent, compared to 47 percent in Germany. Amongst United States participants, 14 percent might not keep in mind when they had last altered their longest-standing password.

Canada and the benefit issue

Canada was among the 8 nations in the research study, and the outcomes expose some notable Canadian behaviours. Eighteen percent of Canadian participants reported counting on memory for passwords, according to NordPass. Canadians were likewise amongst those for whom integrating browser-based and third-party password storage was among the more popular techniques.

The larger research study discovered that about 40 percent of participants keep qualifications in their chosen web browser’s integrated password supervisor, while just 13 percent rely specifically upon a devoted password supervisor. Convenience for that reason sits at the centre of the problem. Individuals collect digital services and desire gain access to without friction. A quickly remembered password, specifically one ingrained in memory for several years, might appear appealing specifically due to the fact that the user does not need to think of it.

Durability by itself is not the only problem. Password reuse can turn one jeopardized credential into an issue impacting a number of accounts. Previously NordPass research study highlighted this issue, while its most current work argues that insecure storage and password reuse can leave even obviously strong qualifications susceptible.

The Gen Z cybersecurity paradox

Maybe crucial finding issues more youthful grownups. Individuals aged 18 to 24 were the least most likely age to have actually altered their longest-standing password throughout the previous year and the most likely to report never ever having actually altered it. Password-change recency increased with age and peaked amongst 55-to-64-year-olds. This makes complex presumptions surrounding the idea of the “digital native”

Maturing surrounded by mobile phones, apps and online services might produce self-confidence in utilizing innovation. It does not instantly produce great security practices. There is supporting proof in NordPass’s Top 200 Most Common Passwords research study. Its generational analysis discovered remarkably comparable vulnerabilities throughout age. Easy mathematical strings included plainly amongst every generation, with “12345” or “123456” inhabiting the leading positions. The research study was based upon statistically aggregated information originated from public breaches and dark-web repositories in between September 2024 and September 2025.

For Canadian companies, banks and universities, this difference matters. A more youthful user might be extremely competent with digital platforms while still making fundamental errors around authentication. The concern likewise shows up versus a worrying background for Canadian cybersecurity.

Current research study from threat-intelligence business Flare discovered that the volume of Canadian financial-services qualifications appearing within thief logs grew 77.9 percent in its year-on-year contrast. The exact same research study recommended Canada had the greatest percentage of employee-linked logs amongst the 3 North American nations taken a look at.

These findings originate from a various research study and must not be translated as being brought on by the password behaviours recognized by NordPass. Taken together, nevertheless, they highlight the substantial worth wrongdoers can connect to jeopardized qualifications. Canadian organisations themselves acknowledge that the larger danger environment is ending up being harder to handle. A 2026 CIRA study of more than 500 Canadian cybersecurity decision-makers discovered that 76 percent had actually increased cybersecurity budget plans over the preceding year, yet just 67 percent considered their financial investment enough to equal hazards. Authentication, for that reason, is not merely a private user’s issue. A jeopardized credential can possibly end up being an organisational issue when individual and expert digital identities overlap.

Moving beyond the password

The longer-term response might include making passwords lesser in the very first location. NordPass reports that the typical variety of passwords amongst its users fell from 168 in 2024 to 120 in 2026. The business recommends that adoption of options consisting of single sign-on, biometrics and passkeys might be adding to the decrease, although this description exists as an analysis instead of a shown cause.

Passkeys are particularly substantial since they represent a various method to authentication instead of just another guideline for building a password. NordPass recognizes passkeys, together with multi-factor authentication, distinct passwords and password-management tools, amongst the methods readily available for minimizing credential threat. The research study eventually points towards an unpleasant lesson. The most recent gadget on a Canadian user’s desk can still be secured by among the earliest aspects of their digital identity.

Cybersecurity awareness for that reason requires to develop beyond informing individuals just to “select a much better password”. The more important difficulty is assisting Canadians acknowledge that qualifications belong to their digital identity facilities. They require to be distinct, properly safeguarded and changed when jeopardized, while more powerful authentication approaches can decrease reliance on passwords entirely.