Strong Passwords, Safer Accounts
Create a unique, long password for every account, store it in a reputable password manager, and enable multifactor authentication (MFA). Length and uniqueness matter most: a stolen password cannot unlock another account, while a long password is harder to guess. Start with email, banking, cloud storage, social media, and any account that can reset others.
Build Passwords That Resist Guessing
Use at least 15 characters when a service allows it. A manager can generate random strings such as “vQ7!L2#zN9@cR4”; you do not need to memorize them. For a password you must type, choose an unrelated passphrase, for example, “Harbor-Cactus-Lantern-Tea.” Avoid common names, birthdays, keyboard paths, quotations, team names, and predictable substitutions such as “P@ssw0rd.”
Use a Password Manager Safely
A password manager creates, stores, and autofills separate credentials, reducing both reuse and phishing mistakes. Protect its vault with a memorable, unique master passphrase and MFA. Save its recovery code offline in a secure place. Keep the app, browser, and devices updated; lock devices with a PIN or biometric control. Never approve an unexpected login prompt.
What If a Site Rejects Long Passwords?
Use the maximum allowed length, keep it unique, and enable MFA. If a site truncates passwords silently or limits them severely, treat the account as higher risk and avoid storing sensitive information there when practical.
Add Layers Beyond the Password
Turn on MFA, preferring a passkey, security key, or authenticator app when available. SMS codes still add protection, but phone numbers can be hijacked. Passkeys are especially useful because they are tied to the legitimate site and resist typical phishing.
Check account protections regularly:
- Remove old devices and unused app access.
- Enable login alerts and review recent sessions.
- Update recovery email addresses and phone numbers.
Respond Quickly to a Suspected Breach
If a password appears in a breach, change it immediately, then change every account where it was reused. Sign out sessions, inspect details and forwarding rules, and contact the provider if access was altered. Today, install a password manager, replace your three most reused passwords, and activate MFA.