Why passwords are worth a little attention
Most people have dozens of online accounts, and each one asks for a secret. The easy response is to use something memorable and reuse it, which is exactly what makes accounts vulnerable. When a service suffers a data breach, the leaked passwords are often tried on other websites. If you used the same one elsewhere, a problem at one company becomes a problem everywhere.
This article offers general information, not a security guarantee. No habit makes an account perfectly safe, and recommendations evolve. But a few steady practices reduce the most common risks without taking much time.
One account, one password
The most useful single habit is to use a different password for each account, especially the ones that matter most. If one is exposed, the damage stays limited to that account.
That raises the obvious problem of remembering many passwords. Memory is not the right tool for it, which is why secure storage matters, and more on that below.
Make passwords long, not clever
Length tends to contribute more to strength than odd symbols. A long passphrase made of several unrelated words is usually harder to guess than a short string with substitutions like “@” for “a,” because attackers’ tools are built to try those common tricks. Some points:
- Aim for a length of at least 12 to 16 characters for important accounts, and longer if the service allows it.
- Avoid personal details such as names, birthdays, pet names and addresses, which others may be able to find or guess.
- Avoid common words and patterns such as “password,” keyboard sequences or simple number endings.
- Do not make small changes to an old password, such as adding a “2” at the end, as these are often predictable.
Guidance from official bodies has shifted over the years, so if you are unsure, check current recommendations from your country’s cybersecurity agency.
Choose where to store them
Since memorizing dozens of strong passwords is unrealistic, you need somewhere to keep them. The sensible options each have trade-offs.
- A dedicated password manager. This is a program that stores your passwords in an encrypted vault, protected by one strong main password. Many people find it the most practical option because it can also generate random passwords and fill them in for you. If you lose the main password, recovery can be difficult or impossible, so keep it safe.
- Your browser’s built-in saving feature. It is convenient and is better than reusing passwords, though it is usually only as secure as your device and the account that syncs it. Lock your computer and phone with a strong screen lock.
- A written notebook kept at home. Paper is not connected to the internet and cannot be hacked remotely. It can be lost, stolen or read by someone in your household, so it suits a home with few risks of that sort and a locked drawer. It should not be carried around.
Whichever you pick, avoid storing passwords in a plain text file called “passwords,” in an email to yourself, or in a general notes file. If one of those is hacked or shared, everything is exposed.
Add a second step where you can
Many services offer two-step sign-in, sometimes called two-factor or multi-factor authentication. It requires something besides the password, such as a code from an app or a message, or a physical key. Even if your password leaks, an attacker would still need the second item.
Start with the accounts that would hurt most to lose: your main email, banking, and any account that can reset others. Email is especially important, because many services send password-reset links to it. Different methods have different strengths, and text-message codes are generally considered less robust than app-based or hardware-based ones, though any second step is typically better than none.
Keep recovery options up to date, such as a backup email address or backup codes, and store backup codes somewhere safe and separate. Losing the second factor without a recovery path can lock you out permanently.
Prioritize what to fix first
You do not need to fix everything in a weekend. Work in this order:
- Your primary email account.
- Financial accounts and anything linked to payment.
- Accounts that store personal documents or health information.
- Work-related accounts, following your employer’s rules, which may override your preferences.
- Everything else, a few at a time.
A short session of fifteen minutes, once a week, will get through a surprising number. You can fold it into a regular routine, in the manner of habit stacking, such as doing it with your morning coffee.
Watch for phishing
Even a strong password does not help if you type it into a fake website. Be cautious about unexpected messages that create urgency, ask you to sign in, or link to a login page. Instead of clicking, go to the site directly by typing its address or using a bookmark. A password manager that only fills in credentials on the correct website can serve as a useful warning sign, since it will not recognize a lookalike.
Unsubscribing from unwanted emails also reduces the volume of messages in which a fake one could hide, which is one more benefit of a periodic notification cleanup.
If something goes wrong
If you learn that a service you use has had a breach, or you suspect your account was accessed, change that password right away, along with any other account where you used the same one. Check the account’s recent activity and recovery settings, and enable a second step if you have not. For financial accounts, contact the provider through its official channels. Laws and protections vary by country, so look for official guidance where you live.