Why passwords still matter
Passwords are the key to most of what you do online: email, banking, shopping, photos, work. Newer options such as passkeys are spreading, but passwords will be around for years, and a weak one can undo a lot of otherwise careful behavior. The good news is that you do not need to memorize dozens of complicated strings to do this well.
How weak and reused passwords fail
Attackers rarely sit and guess one password at a time by hand. Several quieter methods are far more common.
Guessing common choices. Software can try huge lists of popular passwords, names, dates and simple patterns very quickly. Swapping a letter for a symbol, such as an “@” for an “a”, barely slows it down because these tricks are widely known.
Credential stuffing. When a website is breached, its stolen logins are often shared or sold. Attackers then try the same email and password pair on other services, hoping people reused them. This is the central problem with password reuse: the strength of your bank password does not matter if the same one was leaked from a forgotten forum.
Phishing. A convincing fake sign-in page can capture even a strong password. This is why a good password alone is not enough, and why it helps to recognize phishing messages.
Personal information. Passwords built from pet names, birthdays or team names can be guessed by someone who has read your public profiles. Oversharing makes these guesses easier.
Length and unpredictability matter more than clever substitutions. Adding length generally makes a password much harder to guess, while a short password remains risky however many symbols it contains.
Use a different password for every account
If you take only one idea from this article, make it this one. Unique passwords limit the damage of any single leak to a single account. Most people find this impossible without help, which leads to the next tool.
Password managers
A password manager stores your logins in an encrypted vault protected by one strong main password. It can generate long random passwords and fill them in for you, so you do not need to remember or type them. Many also warn you if a saved login appears in a known data breach or if a site looks suspicious. Browsers and phone systems have built-in versions, and standalone products exist as well; what matters is that you choose one from a trustworthy maker and understand how to recover it.
Some tradeoffs deserve honesty. You are placing many eggs in one basket, so the main password must be strong and the vault should itself be protected by two-step sign-in. If you forget the main password, recovery may be impossible by design, so learn the recovery options when you set it up. Even so, security professionals broadly consider a well-protected manager far safer than reusing passwords or keeping them in a notes file. Our overview of what password managers do explains who benefits most.
Passphrases for the passwords you must remember
A few passwords have to live in your head: the main password for a manager, the one for your device, perhaps your email. For these, a passphrase works well. It is a string of several unrelated words, which is long enough to be hard to guess yet easier to remember than random characters. Choose the words yourself, avoid famous quotes, song lyrics or anything connected to you, and do not reuse the phrase elsewhere. The approach to memorable passphrases is covered separately in more detail.
Do not rely on security questions
Questions such as a mother’s maiden name or first school can often be answered from public information or old social posts. Where a site insists on them, treating the answers like extra passwords, random and stored in your manager, is safer than answering truthfully. Our notes on security questions explain this further.
Add a second sign-in step
Two-step sign-in asks for something beyond the password, such as a code from an authenticator app, a prompt on your phone or a physical security key. Even if someone steals your password, they are blocked unless they also have that second item. It is not perfect, because some phishing pages relay codes in real time and text messages can be intercepted in rare cases, but it blocks a large share of takeovers.
Prioritize in this order:
- Your main email account, because it can reset almost everything else.
- Financial accounts and anything that stores payment details.
- Your password manager.
- Social media and cloud storage.
- Everything else that offers it.
If you are choosing between methods, see the comparison of verification code options. Save any backup codes somewhere safe, and keep recovery options current so you do not lock yourself out.
How often to change passwords
Forced constant changes tend to produce predictable variations. A more practical rule is to change a password promptly when there is a reason: a breach notice, a suspicious login, a device lost, or a password shared with someone you no longer trust. The question is discussed under password rotation.
Sharing and storage
Avoid sending passwords by ordinary text or email, and avoid writing them on sticky notes near a computer. If you must share access with family or coworkers, use a feature built for shared account access rather than passing along one login informally.
A starting plan
You can improve things a lot in a single sitting. Set up a password manager, change your email and financial passwords first, turn on two-step sign-in for those same accounts, and replace reused passwords over the following weeks as you log in. There is no need to do everything today. Progress on the accounts that matter most already reduces your risk, though no method can promise complete protection.