If you reuse a handful of passwords with small variations, one breach at a site you barely remember can expose your email, your bank and every account that resets through them. Memorizing dozens of unique, random passwords is not a realistic fix.
What works is a three-part system: a password manager that generates and stores every password, one long passphrase you actually memorize, and two-factor authentication on the accounts that matter most. Setup takes an afternoon, and the rest happens as you log in.
Quick diagnosis: is your current approach the weak point?
Answer three questions honestly. Do any two important accounts share a password? Do your passwords follow a pattern, such as a base word plus a year and an exclamation mark? If a site emailed you about a breach today, could you say which password you used there?
A yes to any of them is the gap attackers rely on. A peer-reviewed study of billions of leaked credentials and real honeypot attacks showed how reused and slightly mutated passwords put accounts at risk: attackers take a leaked email-and-password pair and try it, along with predictable variations, on other services. This is credential stuffing, and it is why turning “Summer2024!” into “Autumn2024!” offers little protection.
Long, unique, random passwords defeat it. They are only practical if a tool does the remembering.
Step 1: Choose a password manager and install it everywhere
A reputable password manager encrypts your vault on your own device using your master password, so the provider cannot read your logins. If its servers are breached, attackers get scrambled data that still needs your passphrase. The US Cybersecurity and Infrastructure Security Agency recommends password managers for everyday users for exactly this reason.
The main options differ more in price and platform than in core security. Give yourself ten minutes to choose, not a week of research.
| Manager | Cost | Works on | Best fit |
|---|---|---|---|
| Bitwarden | Free tier; low-cost premium | Windows, Mac, Linux, iOS, Android, all major browsers | Anyone who wants a capable free option with open-source code |
| 1Password | Paid subscription after a trial | Windows, Mac, Linux, iOS, Android, browsers | Families and people who want polished apps and easy sharing |
| Proton Pass | Free tier; paid plans | Windows, Mac, Linux, iOS, Android, browsers | Proton Mail users, or anyone who wants built-in email aliases |
| Apple Passwords | Free, built in | iPhone, iPad, Mac; Windows via iCloud for Windows; no Android | Households that use only Apple devices |
Once you have chosen, install it in three places: the browser extension on every computer, the app on your phone, and the phone’s autofill setting. On iPhone that is Settings > General > AutoFill & Passwords; on Android, search Settings for “Autofill service” because the menu varies by manufacturer.
Turn on fingerprint or face unlock so you rarely type the master password. Biometrics are a shortcut to the vault, not a replacement: you will still need the passphrase after restarts and updates.
Step 2: Create one passphrase with dice, not your imagination
Your master password is the only one you memorize, so it needs length and genuine randomness. People are poor at picking random words; we drift toward pets, places and favourite bands. The Electronic Frontier Foundation’s Diceware method removes that bias: roll five dice, look up the five-digit result in the EFF long wordlist, and repeat until you have six words.
The result is a string of unrelated words that is long, meaningless to anyone else, and easier to memorize than it looks after a week of typing it daily. Length does the heavy lifting here; tacking on a symbol adds far less than an extra word.
- Write the passphrase down once and keep the paper somewhere physical and private, such as a locked drawer or document safe. Never on a sticky note by the screen.
- Save the recovery item your manager offers. 1Password generates an Emergency Kit containing your Secret Key; Bitwarden provides a two-step login recovery code and, on premium, emergency access for a trusted contact. Because the provider cannot see your vault, it usually cannot reset a forgotten master password.
- Use this passphrase nowhere else, including your email account.
Step 3: Import your old logins, then fix the dangerous ones first
You do not need to change 150 passwords tonight. Start with your new manager’s import tool, which walks you through exporting the logins already saved in Chrome, Safari, Edge or Firefox.
Two follow-ups matter. Delete the exported file afterwards, because it is an unencrypted list of every password you own; exports like this tend to linger in Downloads, which is one more reason to organize your digital files. Then switch off the browser’s own password saving so you are not maintaining two vaults that drift apart.
Next, open the manager’s security report. 1Password calls it Watchtower, Apple Passwords lists issues under Security, and most others flag weak, reused and exposed passwords in a similar dashboard. Work through flagged accounts in this order:
- Primary email. Whoever controls it can use “forgot password” on almost everything else.
- Your Apple or Google account and your phone carrier account. These control device backups and the number that receives codes.
- Banking, investment and payment apps.
- Work accounts and any shop with a saved card.
- Everything else, changed with the generator the next time you log in.
A freelance sound engineer with 160 imported logins, spread across plugin vendors, sample libraries, studio booking sites and client file-transfer services, and 48 flagged as reused might fix the top dozen in under an hour, then let the remaining 36 roll over as each site comes up. Pairing “log in” with “replace the password” is a simple habit stack, and within a few weeks the reused count shrinks to a handful of rarely used sites.
Step 4: Add a second factor, strongest where it matters
Two-factor authentication means a stolen password alone no longer opens the account. Not every second factor is equal: CISA’s guidance warns that SMS codes can be hijacked through SIM swapping and phone-network interception, and that push approvals can be abused by attackers who spam prompts until someone taps “approve”.
| Method | Security level | Convenience | Best use case |
|---|---|---|---|
| SMS code | Low: vulnerable to SIM swaps and interception | High: nothing to install | Only when a site offers nothing better |
| Authenticator app (TOTP), e.g. Google Authenticator, Microsoft Authenticator | Good: codes stay on your device, but can still be typed into a fake site | Medium: open the app, type six digits | The default for most accounts |
| Passkey | High: phishing-resistant, bound to the real site | High: unlock with face, fingerprint or PIN | Any service that offers it, such as Google, Apple, Microsoft or PayPal |
| Hardware security key (e.g. YubiKey) | Highest: phishing-resistant and physical | Lower: carry it, and buy a spare | Primary email, password manager, finance and admin accounts |
Passkeys deserve a closer look. As the FIDO Alliance explains, passkeys replace passwords and one-time codes with a cryptographic key pair tied to the genuine website, so a look-alike phishing page has nothing to steal. All four managers in the table above can store them.
Setup is similar everywhere: open the account’s Security settings, choose two-step verification, pick authenticator app or passkey, scan the QR code and confirm with the first code. Save the backup codes as a secure note in your manager, and print the ones for your email.
One exception: keep the second factor for your password manager and primary email outside the vault, in a separate authenticator app or on a hardware key. Otherwise a locked vault locks you out of the very accounts you would use to recover it.
Three awkward cases and what to do
- A site rejects the generated password. Open the generator settings, adjust the length or toggle symbols off, and generate again. You still get the strongest password the site permits.
- A partner or family needs the same login. Use a shared vault or family plan, or Apple’s shared password groups. Never send a password by text or email.
- A breach email arrives. Search the vault for that service, generate a new password, and check the security report for any site that shared the old one. With unique passwords, the damage stops at that single account.
Autofill also works as a phishing alarm. If the manager offers no login on a page that looks exactly like your bank, check the address bar before typing anything.
Keeping the system healthy
Forget the old 90-day rule. NIST’s digital identity guidelines say services should not force routine password changes and should require a change only when there is evidence of compromise, because forced rotation pushes people toward predictable patterns.
Once a month, spend five minutes on the security report: fix anything newly flagged, close accounts you no longer use, and add a passkey wherever one is newly offered. It fits neatly into a weekly digital review if you already run one.
Finally, let breach alerts from your manager through even if you silence almost everything else; our rules for managing notifications explain how to set that exception. Everything else in the system now runs on autopilot.
1 Comment