For about twenty years the standard advice was: make it complicated, change it every ninety days, and never write it down. What that produced was a season, a year, and a punctuation mark on the end, incremented every quarter, written on a sticky note under the keyboard and reused across nine sites.
Guidance has since moved on, and it moved in a direction that is easier to live with. The short version: long beats complicated, unique beats memorable, and the machine should be doing the remembering.
One password per account, and you don't memorize them
Reuse is the problem that dwarfs the others. When a website is breached, the stolen list of email addresses and passwords gets tried against every other popular service, automatically, at scale. Your bank password does not have to be weak to be compromised. It only has to be the same one you used on a hobby forum you signed up to years ago and forgot about.
The only practical way to have a different password everywhere is to stop trying to remember them. A password manager generates a long random string per account, fills it for you, and syncs across your devices. Browsers now include a decent one for free; dedicated apps add cross-browser support, secure sharing with a partner, and a place to keep recovery codes. Either is enormously better than the pattern you are currently reusing.
There is a side benefit that gets overlooked. A password manager only offers to fill a password on the exact domain it was saved for. When you land on a convincing copy of your bank's login page and the manager sits there silently, that silence is a warning. Human judgment is fallible about lookalike domains; string matching is not.
The three passwords you still have to know
You need to memorize three: the master password that opens the manager, the password for your primary email, and the code that gets you into your phone. Everything else lives in the vault.
For those, length is what matters. A string of four or five unrelated words is far harder to crack than eight characters of punctuation soup, and you can actually remember it. Choose words that don't form a quotation or a phrase — random is the point. Then write the master password on paper and put it wherever you keep your passport. The threat model for a piece of paper in a drawer at home is not the same as the threat model for a password typed into a hundred websites.
Your email account deserves particular care, because it is the master key to everything else. Anyone who controls it can trigger a password reset on most of your other accounts. Give it your strongest protection and the best second factor you have.
Turn on a second factor, and pick a good one
A second factor means a stolen password alone is not enough to get in. Not all second factors are equally good, but the gap between having one and having none is much larger than the gap between the types.
| Passkey or hardware security key | Cryptographically bound to the real site, so a phishing page cannot use it. The strongest option available to households. |
|---|---|
| Authenticator app code | A rotating six-digit code generated on your device. Strong, works offline, and phishable only if you type it into a fake site. |
| Push approval prompt | Convenient. Approve nothing you did not just start yourself — repeated prompts at odd hours mean someone has your password. |
| Text message code | Weakest of the four, because phone numbers can be moved to another SIM by someone impersonating you. Still much better than nothing. |
Passkeys are the genuinely new thing here and worth adopting where offered. Instead of a shared secret, your device keeps a private key and hands the site a matching public one. Nothing reusable is stored on the server, so a breach of that site leaks nothing that can log in as you, and there is no code to be tricked into typing. Most implementations sync through your platform account or password manager, so losing a phone is not losing the account.
Whatever you switch on, save the recovery codes it offers. Print them or write them down, and keep them with the master password note. The most common way people lock themselves out permanently is enabling two-factor on a phone and then dropping the phone off a bridge.
Habits that turned out not to matter
- Changing passwords on a schedule. Rotation without cause just pushes people toward predictable variations. Change a password when there is a reason: a breach notice, a shared password, a suspicion.
- Forcing a symbol and a number into a short password. Padding an eight-character password with punctuation adds far less than making it four characters longer.
- Answering security questions honestly. Your mother's maiden name is not a secret. Treat those fields as extra passwords and store the nonsense answers in your manager.
- Refusing to write anything down. Written down and locked in a drawer beats reused across the internet, every time.
What to do when a service you use is breached
- Change the password on that account immediately, to a new random one from the manager.
- Search your vault for anywhere you used the same or a similar password, and change those too. This is the step that actually contains the damage.
- Turn on a second factor for that account if it was not already on.
- Check whether the breach included answers to security questions or a recovery email, and change those as well.
You can check whether your address has appeared in known breaches at Have I Been Pwned, a free service that is well established and does not ask for your password. Most password managers now run a version of the same check against your saved logins and will flag reused and exposed entries. Run that report once. It is uncomfortable reading, and it gives you a to-do list in priority order.
None of this needs doing in one sitting. Install the manager, move the email and banking logins in first, and let everything else get captured as you sign in over the following months. The accounts you use are the accounts that matter.