Why Passwords Matter More Than Ever
Your passwords are the keys to your online life. Email, banking, shopping accounts, social media, and medical records are all protected by passwords. If someone gets your password, they can access your money, steal your identity, or lock you out of your own accounts.
Here is why password security has become so important:
- Data breaches are constant. Major companies get hacked regularly. When a company is breached, the usernames and passwords of millions of customers are stolen and sold to criminals. If you use the same password on multiple sites, one breach can compromise all of your accounts.
- Criminals use automated tools. Hackers use software that can try thousands of password combinations per second. Simple passwords like "password123" or "John1950" can be cracked in seconds.
- Password reuse is the biggest risk. Studies show that over 60% of people use the same password for multiple accounts. Criminals know this, so when they steal a password from one site, they immediately try it on banks, email providers, and shopping sites.
Did you know? The average person has over 100 online accounts. Managing unique passwords for each one is impossible without a system, which is why password managers were invented.
How to Create Strong Passwords
A strong password does not have to be impossible to remember. Here are proven methods for creating passwords that are both strong and manageable:
The Passphrase Method (Recommended)
Instead of a single word with numbers and symbols, use a passphrase: a series of four or more unrelated words strung together. Passphrases are much harder for computers to crack but easier for you to remember.
Examples of strong passphrases:
- "correct horse battery staple" (four random words)
- "purple Tuesday pancake garden" (no logical connection between words)
- "bookshelf raindrop trumpet eleven" (random and memorable)
You can make passphrases even stronger by adding a number or symbol between words: "purple-Tuesday-pancake-garden-42"
What Makes a Password Weak
Avoid these common mistakes:
- Personal information: Your name, birthday, anniversary, pet's name, grandchild's name, address, or phone number. Criminals can find this information on social media.
- Common substitutions: Replacing "a" with "@" or "o" with "0" does not fool hacking software. "P@ssw0rd" is almost as weak as "Password."
- Keyboard patterns: "qwerty," "123456," "asdfgh" and similar patterns are in every hacker's dictionary.
- Single dictionary words: Even with numbers added, "sunshine99" or "football1" are easily cracked.
- Short passwords: Anything under 12 characters is increasingly vulnerable. Aim for 16 characters or more.
Warning: Never write passwords on sticky notes attached to your computer monitor. If you need to write them down, keep them in a locked drawer or safe, never near your computer.
The One Rule That Matters Most
Use a different password for every account. This is the single most important thing you can do. If one account is compromised, all your other accounts remain safe. A password manager (explained in the next section) makes this easy.
Get the Full Guide — Free
Enter your email to unlock the complete guide. You can also print it or save as PDF.
We respect your privacy. No spam, unsubscribe anytime.
Privacy Policy
Introduction to Password Managers
A password manager is a secure app that remembers all your passwords for you. You only need to remember one master password to unlock the manager, and it handles everything else. Think of it as a secure digital safe for all your login information.
How Password Managers Work
- You install the app on your computer and phone
- You create one strong master password that unlocks the manager
- The manager generates and stores unique, strong passwords for every website
- When you visit a website, the manager fills in your username and password automatically
- Your passwords are encrypted so that even the password manager company cannot read them
Recommended Free Password Managers
You do not need to spend money on a password manager. Here are trustworthy free options:
- Bitwarden (Free plan): The best free option. Works on computers, phones, and tablets. Unlimited passwords. Open-source, meaning security experts can verify it is safe. Visit bitwarden.com to get started.
- Apple Passwords (built into iPhones and Macs): If you use Apple devices, the built-in Passwords app works well. It syncs across your iPhone, iPad, and Mac automatically through iCloud.
- Google Password Manager (built into Chrome): If you use Google Chrome as your web browser, it has a built-in password manager that works across devices. Access it at passwords.google.com.
Getting Started with Bitwarden (Step by Step)
- Go to bitwarden.com and click "Get Started" to create a free account
- Choose a strong master password using the passphrase method described above. This is the one password you must memorize
- Write your master password down and store it in a safe or locked drawer (not on your computer)
- Install the Bitwarden browser extension for your web browser (Chrome, Firefox, Safari, or Edge)
- Install the Bitwarden app on your phone from the App Store (iPhone) or Google Play (Android)
- As you log into websites, Bitwarden will ask if you want to save the password. Click "Save"
- Over time, Bitwarden will have all your passwords stored securely
Tip: You do not have to enter all your passwords at once. Start by saving passwords as you naturally log into websites over the next few weeks. Eventually, Bitwarden will have them all.
Setting Up Two-Factor Authentication Step by Step
Two-factor authentication (also called 2FA or two-step verification) adds a second layer of protection to your accounts. Even if someone steals your password, they cannot get in without the second factor.
What Is Two-Factor Authentication?
When you log in with 2FA enabled, you enter your password (first factor) and then prove your identity a second way (second factor). The second factor is usually a code sent to your phone or generated by an app.
Types of Two-Factor Authentication (From Best to Good)
- Authenticator App (Best): An app on your phone generates a new 6-digit code every 30 seconds. Recommended apps include Google Authenticator or Microsoft Authenticator (both free).
- Text Message / SMS (Good): A code is sent to your phone as a text message. This is less secure than an app because phone numbers can be stolen, but it is still much better than no 2FA at all.
- Email Code (Acceptable): A code is sent to your email address. Use this if text and app options are not available.
How to Turn On 2FA for Your Most Important Accounts
For your email (Gmail):
- Go to myaccount.google.com
- Click "Security" on the left side
- Under "How you sign in to Google," click "2-Step Verification"
- Click "Get Started" and follow the instructions
- Choose to receive codes by text message or authenticator app
For your bank:
- Log into your bank's website or app
- Go to Settings or Security settings
- Look for "Two-Factor Authentication," "Two-Step Verification," or "Extra Security"
- Follow the instructions to set it up (most banks use text message codes)
Which accounts to protect first:
- Email (most important, because password resets go here)
- Bank and financial accounts
- Shopping accounts (Amazon, etc.)
- Social media accounts
Warning: When you set up 2FA, most services give you backup codes. Write these down and store them in a safe place. If you lose your phone, these codes are the only way to get back into your account.
What to Do If Your Account Is Hacked
If you notice suspicious activity on any account, such as emails you did not send, purchases you did not make, or password change notifications you did not request, act immediately:
Step 1: Change the Password Immediately
Go directly to the account's website (do not click any links in suspicious emails) and change your password. If you cannot log in because the hacker changed the password, use the "Forgot Password" feature to reset it through your email.
Step 2: Check Your Email Account
If any account is hacked, your email may also be compromised. Change your email password too, and check for any email forwarding rules you did not create. Hackers sometimes set up forwarding to receive copies of all your emails.
Step 3: Enable Two-Factor Authentication
If 2FA was not already enabled, turn it on now. This prevents the hacker from getting back in even if they still know your old password.
Step 4: Check Other Accounts
If you used the same password on other accounts, change those passwords immediately. This is the most common way hackers access multiple accounts.
Step 5: Watch for Follow-Up Scams
After a hack, scammers may contact you pretending to be "account security" or "fraud prevention." Your bank or email provider will never call you and ask for your password. If someone calls claiming to help, hang up and call the company directly using the number on their official website.
Tip: Visit haveibeenpwned.com and enter your email address. This free service tells you if your email appeared in any known data breaches. If it has, change the password for every account that used that email and password combination.
Password Security Checklist
Use this checklist to strengthen your account security. You do not have to complete everything at once. Work through it over a few days or weeks:
- I use a unique password for every online account (no reusing passwords)
- My passwords are at least 12 characters long, ideally 16 or more
- I do not use personal information (names, birthdays, addresses) in my passwords
- I have installed a password manager (Bitwarden, Apple Passwords, or Google Password Manager)
- My password manager's master password is strong and memorized
- I have my master password written down and stored in a safe place (not near my computer)
- I have turned on two-factor authentication for my email account
- I have turned on two-factor authentication for my bank accounts
- I have turned on two-factor authentication for my shopping accounts (Amazon, etc.)
- I have saved my 2FA backup codes in a safe place
- I have checked haveibeenpwned.com to see if my email has been in any data breaches
- I have changed any passwords that were exposed in data breaches
- I know not to share passwords by email, text, or phone (no legitimate company will ask for them)