Canadians are carrying childhood passwords into adulthood, and Gen Z may be the most reluctant to change

Canadians have embraced online banking, shopping, streaming, social media and cloud-based working, yet a remarkably old piece of technology continues to sit between many people and their digital lives: the password. Research released by NordPass indicates that passwords can remain in use for years, or even decades. Some originated when their users were considerably younger, meaning credentials devised for relatively inconsequential early online activities may subsequently be used in an adulthood containing banking, work and other valuable accounts.

The study presents a particularly interesting finding for a technology-literate society such as Canada. Generation Z emerged as the age group most reluctant to change passwords, despite being closely associated with digital technology.   This suggests that digital familiarity should not be confused with cybersecurity awareness.

Passwords grow old with their owners

The NordPass research involved 7,861 people aged between 18 and 74 across Canada, Australia, France, Germany, Italy, Spain, the UK and US. The survey on password-storage habits was conducted by Nord Security between 26 March and 6 April 2026.  Globally, 54 per cent of those surveyed said that they had changed their longest-standing password during the previous 12 months.

That leaves a substantial group whose oldest credentials have persisted for longer. The research supplied to Digital Journal indicates that around 15 per cent had changed their longest-standing password within three years and 8 per cent three to five years previously. Four per cent were still using credentials created five to ten years earlier, while up to 3 per cent had passwords more than a decade old. Around 6 per cent said they had never changed their oldest password.

There were pronounced national differences. Italy recorded the highest proportion of recent password changes at 65 per cent, compared with 47 per cent in Germany. Among US respondents, 14 per cent could not remember when they had last changed their longest-standing password.

Canada and the convenience problem

Canada was one of the eight countries in the research, and the results reveal some noteworthy Canadian behaviours. Eighteen per cent of Canadian respondents reported relying on memory for passwords, according to NordPass. Canadians were also among those for whom combining browser-based and third-party password storage was one of the more popular approaches.

The wider study found that about 40 per cent of respondents store credentials in their preferred browser’s built-in password manager, while only 13 per cent rely exclusively upon a dedicated password manager. Convenience therefore sits at the centre of the issue. People accumulate digital services and want access without friction. An easily remembered password, especially one embedded in memory for many years, may appear attractive precisely because the user does not have to think about it.

Yet longevity by itself is not the only issue. Password reuse can turn one compromised credential into a problem affecting several accounts. Earlier NordPass research highlighted this problem, while its latest work argues that insecure storage and password reuse can leave even apparently strong credentials vulnerable.

The Gen Z cybersecurity paradox

Perhaps key finding concerns younger adults. Participants aged 18 to 24 were the least likely age group to have changed their longest-standing password during the previous year and the most likely to report never having changed it. Password-change recency increased with age and peaked among 55-to-64-year-olds.  This complicates assumptions surrounding the concept of the “digital native”.

Growing up surrounded by smartphones, apps and online services may produce confidence in using technology. It does not automatically produce good security practices. There is supporting evidence in NordPass’s Top 200 Most Common Passwords research. Its generational analysis found surprisingly similar vulnerabilities across age groups. Simple numerical strings featured prominently among every generation, with “12345” or “123456” occupying the top positions. The research was based on statistically aggregated data derived from public breaches and dark-web repositories between September 2024 and September 2025.

For Canadian employers, financial institutions and universities, this distinction matters. A younger user may be highly proficient with digital platforms while still making basic mistakes around authentication. The issue also arrives against a concerning backdrop for Canadian cybersecurity.

Recent research from threat-intelligence company Flare found that the volume of Canadian financial-services credentials appearing within stealer logs grew 77.9 per cent in its year-on-year comparison. The same research suggested Canada had the highest proportion of employee-linked logs among the three North American countries examined.

These findings come from a different study and should not be interpreted as being caused by the password behaviours identified by NordPass. Taken together, however, they underline the considerable value criminals can attach to compromised credentials. Canadian organisations themselves recognise that the wider threat environment is becoming harder to manage. A 2026 CIRA survey of more than 500 Canadian cybersecurity decision-makers found that 76 per cent had increased cybersecurity budgets over the preceding year, yet only 67 per cent considered their investment sufficient to keep pace with threats.  Authentication, therefore, is not simply an individual user’s concern. A compromised credential can potentially become an organisational problem when personal and professional digital identities overlap.

Moving beyond the password

The longer-term answer may involve making passwords less important in the first place. NordPass reports that the average number of passwords among its users fell from 168 in 2024 to 120 in 2026. The company suggests that adoption of alternatives including single sign-on, biometrics and passkeys may be contributing to the reduction, although this explanation is presented as an interpretation rather than a demonstrated cause.

Passkeys are especially significant because they represent a different approach to authentication rather than simply another rule for constructing a password. NordPass identifies passkeys, alongside multi-factor authentication, unique passwords and password-management tools, among the approaches available for reducing credential risk.  The study ultimately points towards an uncomfortable lesson. The newest device on a Canadian user’s desk can still be protected by one of the oldest elements of their digital identity.

Cybersecurity awareness therefore needs to evolve beyond telling people simply to “choose a better password”. The more pressing challenge is helping Canadians recognise that credentials are part of their digital identity infrastructure. They need to be unique, appropriately protected and replaced when compromised, while stronger authentication methods can reduce dependence on passwords altogether.