Password Habits That Actually Work in Real Life
Good password advice fails when it is too hard to follow. These habits are simple enough to keep.
Length beats cleverness
A long passphrase of several unrelated words is both easier to remember and harder to crack than a short jumble of symbols. Aim for at least fourteen characters on important accounts.
One account, one password
The biggest risk is reuse. When a website is breached, criminals try the same email and password on other services. Using a different password everywhere stops one leak from becoming many.
Let a manager do the remembering
A password manager creates and fills unique passwords so you only memorise one strong master passphrase. Browsers and phones include built-in options, and dedicated apps exist too. Choose a reputable one, protect it well and set up a recovery method.
Add a second step
Two-step verification asks for something besides your password. In order of strength:
- Security keys and passkeys.
- Authenticator apps with rotating codes.
- Text message codes, which are better than nothing.
Start with your main email account, because it can reset almost everything else.
About passkeys
Passkeys let you sign in with your fingerprint, face or device PIN. They cannot be tricked by fake websites, and more services support them every year. Turn them on when offered.
Check for leaks
Services like Have I Been Pwned will tell you whether your email address appeared in a known breach. If it did, change that password and any copy of it.
Avoid these
- Passwords based on pets, birthdays or sports teams.
- Sharing passwords by chat or email.
- Saving them in unprotected notes.
- Typing a password after following a link in an unexpected message.
A five-minute starting plan
Secure your email first, turn on two-step verification, install a password manager, and update your bank and shopping passwords. Work through other accounts as you log in over the following weeks.
This guide is general information, not professional advice. Menus, features and prices change between versions and regions. See our disclaimer.