What makes a password strong
A strong password is one that is hard to guess and that you use in only one place. Length matters more than most people expect. Attackers rarely type guesses by hand; software tries enormous numbers of candidates, starting with common words, names, dates and predictable patterns. A longer password has far more possibilities for that software to work through.
Passphrases are a practical way to get length. Four or more unrelated words strung together are typically both long and memorable. Predictable tricks are weaker than they look: swapping an “a” for “@” or adding “1” at the end is a pattern attackers know about.
Things to avoid:
- Names, birthdays, pets, favorite teams or anything someone could find on your social profiles.
- Keyboard runs and common phrases.
- Small variations of an old password, such as changing a number each time.
- Any password you have used on another site.
Why uniqueness matters most
Companies suffer data breaches, and when one happens the leaked email and password pairs are often tried on other services. If you reuse a password, a breach at a small forum can become a break-in at your work email. A unique password for each account contains the damage to a single site.
The catch is obvious: you cannot remember dozens of long, unique passwords. That is the problem password managers solve.
What a password manager does
A password manager is a program that stores your logins in an encrypted vault. You unlock the vault with one strong master password, and the manager then does the rest.
- It generates long random passwords for new accounts.
- It fills in logins for you, usually only on the site address it saved them for. That behavior can also help you notice a fake site, because the manager will not offer to fill a login on an address it does not recognize.
- It can sync the vault across your devices so your passwords are available on your phone and computer.
- Some also store secure notes, and some can flag reused or weak passwords.
Some managers are built into browsers or operating systems, and some are standalone products. The differences are in features, how syncing works and who can manage them in a company. Weigh those against your needs, and see our broader framework for tool evaluation if you are choosing.
The trade-offs
A password manager is a good idea for most people, but it is a trade, not a magic fix.
Single point of focus. Putting everything in one vault makes that vault valuable. This is why the master password must be long, unique and never reused, and why a second login step on the manager itself is a good idea. Reputable managers encrypt the vault so that stored passwords are not readable without your master password, but that depends on the design, so read how a given product describes its approach.
Forgetting the master password. Many managers cannot recover the vault if you forget it, precisely because they cannot read it. Check what recovery options exist and store any recovery key somewhere safe, such as printed and kept in a secure place.
Dependence and lock-in. If you rely on one tool, moving later takes effort. Look for an export option, and consider the same issues covered under vendor lock-in.
Convenience risks. Auto-fill is convenient, but a device that is left unlocked also exposes your vault. Use a screen lock and consider having the manager lock itself after a period of inactivity.
For most people, the risk of reusing weak passwords is larger than the risk of using a well-built manager. That is a general judgment rather than a guarantee, and your workplace may have its own policy to follow.
Getting started without a big project
You do not have to change everything in a weekend.
- Choose a manager and set a long master password, ideally a passphrase you will not forget.
- Turn on two-factor authentication for the manager itself.
- Begin with your most important accounts: main email, financial services and cloud storage. Replace each password with a generated one as you go.
- Whenever you sign in to any other account, let the manager save or replace the password at that moment.
- Once in a while, run any built-in check for reused or weak passwords and work through the list.
Habits that go with it
- Never share passwords over chat or email. If a team needs to share access, use the sharing features of a team-oriented manager or give each person their own account.
- Do not write passwords on notes stuck to a monitor.
- Change a password when there is a reason: a breach notice, a suspicious sign-in, or a lost device. Changing on a rigid schedule without a reason is less useful than having strong unique ones.
- Be careful with the “security questions” some sites use. Answers such as a mother’s maiden name are often findable; treat them like extra passwords and store random answers in your manager.
If an account is ever taken over, the steps after account compromise start with changing the password from a device you trust. A manager makes that quick, since you can generate a fresh password and see which other accounts might share the old one.