Passwords still protect many of the accounts people use every day, from email and online banking to the systems a business relies on. A password does not need to be difficult to remember and easy to mistype. It also needs to be hard to guess, kept private and different from the passwords used on other accounts.
The simplest way to achieve that is to use a password manager to create and store a unique password for each account. Combine that with multi-factor authentication (MFA) wherever it is available, and a stolen password is much less likely to be enough on its own.
What makes a password strong?
Length and unpredictability matter. A long password generated by a password manager is generally a better choice than a short password with predictable substitutions, such as replacing letters with similar-looking numbers. Avoid names, birthdays, favourite teams and other details that someone could learn from your social media or public information.
If you need to remember a password, a longer passphrase made from unrelated words can be easier to type. Do not use an example from an article as your actual password, and do not reuse a memorable passphrase across accounts.
Make a password manager part of the routine
A password manager can generate strong, unique passwords and fill them in when you sign in. You only need to remember the manager's master password, so make that one long and unique, protect it with MFA where possible, and keep recovery details somewhere secure. Choose a reputable manager and enable its available security protections.
- Use a different password for every important account.
- Do not save passwords in shared documents, notes or unprotected files.
- Never send passwords in plain text over email or chat.
- Do not share a personal login; give each person their own account.
Add multi-factor authentication and passkeys
MFA asks you to prove your identity in another way as well as entering a password. Turn it on first for email, banking, administrator accounts and any service that holds sensitive information. An authenticator app or security key is a good option where supported. Never approve a sign-in prompt you did not initiate, and do not share a one-time verification code with someone who contacts you unexpectedly.
A passkey lets you sign in using a trusted device, usually by unlocking it with your fingerprint, face or screen-lock PIN. Your device's credential manager creates and protects the passkey, so there is no password for you to type into a fake website or accidentally disclose. This makes passkeys resistant to common phishing attacks. The National Cyber Security Centre (NCSC) recommends choosing passkeys over passwords wherever they are available. Set them up for accounts that offer them, using a credential manager and devices you trust, and check how that service lets you recover access if you lose a device. If passkeys are not available, the NCSC advises continuing to use strong passwords generated by a password manager and enabling 2-step verification (2SV).
Good habits at home
- Secure your primary email account first; it can be used to reset many other passwords.
- Use a screen lock and keep your phone, computer and apps up to date.
- Be cautious of unexpected messages asking you to sign in or reveal a code.
- Use the service's official app or type its known address instead of following a suspicious link.
Good habits at work
In a business, one compromised account can expose customer information or provide access to shared systems. Use individual accounts, limit access to what each person needs, and enable MFA for business email, remote access, cloud services and administrator accounts. A business password manager can let colleagues share access without sending the underlying password to one another.
Remove or change access promptly when someone changes role or leaves, and review shared and administrator accounts periodically. Staff should know how to report suspicious sign-in requests and phishing attempts. Avoid relying on frequent password changes or rigid character-combination rules as a substitute for unique passwords, MFA and sensible access controls.
What to do if a password may be compromised
Change it promptly on the affected service, and anywhere else it was reused. Use a new, unique password and review recent sign-ins and account recovery details. Sign out other sessions if the service provides that option, enable MFA, and contact your IT support team if a work account is involved. You do not need to change every password on a schedule when there is no sign of compromise; act when a password is exposed, guessed or otherwise at risk.
A practical starting point
Start with your email and administrator accounts: give each a unique password, store it in a reputable password manager, and turn on MFA or use a passkey where available. Then work through the other accounts you rely on. These steps cannot prevent every attack, but they make stolen or guessed passwords much less useful to an attacker.
For businesses, these habits sit alongside wider safeguards. Our guide to Cyber Essentials for small businesses explains how the scheme can help strengthen your baseline security.
Talk to us
If you need help improving account security across your organisation, Max Cybersecurity can help you identify practical next steps.