Passwords are the keys to your digital life — email, banking, social media, work. Yet most people protect these keys terribly: reusing one password everywhere, picking pet names, never changing defaults. This guide fixes that, step by step.
Why Passwords Get Hacked
Attackers rarely "guess" your password one try at a time. They use smarter methods:
- Credential stuffing: trying leaked username-password pairs from old breaches on new sites. Reused passwords fall instantly.
- Dictionary attacks: trying millions of common passwords and combinations automatically.
- Phishing: tricking you into typing your password into a fake login page.
- Shoulder surfing & leaks: watching you type, or finding passwords in notes, photos, and chats.
The uncomfortable truth: if your password is short, common, or reused, it is already effectively public.
What Makes a Strong Password
Forget the old advice about P@ssw0rd!-style complexity. Modern guidance favors length over complexity. A passphrase — four or more random words strung together — is both stronger and easier to remember:
- Weak:
sunshine123(cracked in seconds) - Better:
Tr7$kQ!mZ(strong but impossible to remember) - Best:
correct-horse-battery-staple(long, memorable, strong)
Aim for at least 14–16 characters for important accounts. Every extra character multiplies the attacker's work enormously.
Use a Password Manager
Humans cannot remember 100 unique 16-character passwords — and should not try. A password manager remembers them for you: you memorize one strong master password, and it generates, stores, and fills unique passwords for every site. Reputable options include Bitwarden (free and open source), 1Password, and KeePass. Your browser's built-in manager is better than reuse, but a dedicated manager is better still.
Turn On Two-Factor Authentication (2FA)
2FA means logging in requires your password plus a second proof — usually a code from an app on your phone. Even if attackers steal your password, they cannot get in without that second factor. Priority order:
- Authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) — best balance of security and convenience.
- Hardware keys (YubiKey) — the gold standard.
- SMS codes — better than nothing, but SIM-swap attacks can intercept them.
Enable 2FA today on: email, banking, social media, cloud storage, and anything work-related.
Passwords to Change Right Now
- Any password you reuse on more than one site.
- Default passwords on your WiFi router, cameras, and smart devices.
- Old, short passwords on email and banking.
- Passwords you have shared with anyone, for any reason.
Common Mistakes to Avoid
- Writing passwords in notes apps, chats, or photos — these get backed up, synced, and stolen.
- Using personal info — birthdays, names, and phone numbers are the first things attackers try.
- "Clever" substitutions —
@forafools no modern cracking tool. - Ignoring breach alerts — when a service tells you to change your password, do it immediately, everywhere you reused it.
Your Action Plan
- Install a password manager today and move your top 10 accounts into it with fresh, unique passwords.
- Enable 2FA on email first (your email can reset everything else — protect it like a master key).
- Change your router's default admin password.
- Work through remaining accounts one evening a week until all are unique.
Next, learn to spot the attacks that try to steal these passwords: read our phishing protection guide.
Passkeys: The Future Beyond Passwords
The industry is moving toward passkeys — cryptographic logins tied to your device's biometrics instead of typed secrets. When a site offers "sign in with passkey," your phone creates a unique key pair: the site keeps the public half, your device keeps the private half locked behind your fingerprint. There is nothing to phish, nothing to reuse, nothing to leak in a breach. Enable passkeys wherever offered (Google, Apple, and Microsoft all support them now) — they are the single biggest usability and security upgrade in decades.
What To Do After a Breach
When you learn a service you use was breached:
- Change that service's password immediately — from a clean device.
- Change the same password anywhere else you reused it (then stop reusing).
- Check haveibeenpwned.com to see the breach scope.
- Watch for targeted phishing using the leaked data ("we know your old password, pay us" extortion emails are almost always bluffs from old breaches).
- Enable 2FA if you had not already.
Passwords at Work and Shared Accounts
Never share passwords over chat, email, or sticky notes. If a team needs shared access, use a business password manager with shared vaults — access can be granted and revoked without anyone seeing the actual password. When someone leaves a team or project, rotate the shared credentials immediately. And if your employer offers single sign-on (SSO), use it: one strong login managed by professionals beats ten weak ones.