Most people use a handful of passwords for dozens of accounts: one for the bank, one 'strong' one for Gmail, and an easy one for everything else. That is understandable, since nobody can remember dozens of different passwords. But it is also one of the main causes of break-ins. When one site you signed up to is breached and passwords leak, attackers automatically try the same email and password on dozens of other sites. If the password is the same, they are in.
What makes a password strong? Mostly length, not special characters. A long password is far harder to crack than a short, complicated one. A good way to build a memorable one is a 'passphrase': four or five random, unrelated words, such as a mix of objects, colors and places. What to avoid: names of family members and pets, birthdays, phone numbers, single dictionary words, and patterns like 'Password1!'. Cracking tools try all of those first.
But even a strong password does not help if you use it in several places. That is where a password manager comes in: software or an app that creates a long random password for every site, stores them encrypted and fills them in automatically when you sign in. You only need to remember one very strong master password. Apple and Google offer built-in password managers on devices and browsers, and there are standalone apps too. A further advantage: a password manager will not fill in your password on a fake site, because the address will not match, which also protects against phishing.
'But what if the manager itself is hacked?' It is a fair concern. Good password managers encrypt data so that even the company cannot read it without your master password. Still, protect that account especially well: a long master password not used anywhere else, and two-step verification. Overall, the risk of a password manager is far smaller than the risk of the same password on twenty sites.
How to start? Do not try to change everything in one evening. Begin with the five most important accounts: your main email, bank, card company, WhatsApp and one social network. Give each a unique password from the manager and turn on two-step verification. From there, each time you sign in to another site, update its password. And on sites that offer a passkey, switch to it; it is even safer than a password.
