- Use a different password for every account, and let a password manager remember them.
- Turn on 2FA (that extra code) for email, banking and anything important.
- When a site offers a passkey, say yes. It's easier and safer.
Passwords: long beats clever
A password like Tr0ub4dor! looks tough but is short, and computers are very good at guessing. A long phrase of random, unrelated words, like maple-tuba-river-sandwich, is easier for you to remember and much harder to crack. Current US government guidance (from NIST) favors length over forced symbols and doesn't recommend changing passwords on a schedule unless there's a reason to think one was exposed.
The bigger danger is reuse. When one website gets breached, criminals try that same email and password everywhere else. One reused password can unlock many accounts.
Password managers: the fix for "I can't remember 100 passwords"
A password manager is an app that creates strong passwords, stores them in an encrypted vault, and fills them in for you. You remember one strong main password; it remembers the rest. Options include the ones built into Apple devices and Google Chrome, plus dedicated apps like 1Password and Bitwarden.
2FA: a second lock on the door
Two-factor authentication (also called 2-step verification or MFA) means signing in takes your password plus something else, usually a code or a tap on your phone. Even if someone steals your password, they still can't get in without that second piece.
| Type of 2FA | How it works | How good is it? |
|---|---|---|
| Text message code | A code is texted to your phone. | Much better than nothing, but texts can be intercepted or redirected by a "SIM swap." |
| Authenticator app | An app (like Microsoft or Google Authenticator) shows a code or asks you to approve. | Stronger. Only approve sign-ins you just started. |
| Security key or passkey | A physical key or your phone or computer confirms it's really you. | Strongest. Built to resist phishing. |
Important: never read a sign-in code to someone who calls or texts you. Real companies don't ask for it.
Passkeys: no password at all
A passkey lets you sign in with the same thing you use to unlock your phone or computer: your face, fingerprint or PIN. Behind the scenes, your device holds a secret key that only works with the real website, so a fake look-alike site can't trick it. There's nothing to remember and nothing for a scammer to steal by phishing.
Google, Apple, Microsoft, Amazon, PayPal and many other services support passkeys. Look for "Create a passkey" or "Sign in with a passkey" in your account's security settings.
Try this today
- Turn on 2FA for your main email account first. Whoever controls your email can reset everything else.
- Pick a password manager and save your 5 most important accounts in it.
- Change any password you've used on more than one site.
- Next time a site offers a passkey, try it.
Test yourself: play Password Strength Challenge, a quick free game.