Length matters more than complexity
Familiar patterns like "P@ssw0rd!" are cracked in seconds. By contrast, a phrase made of 4 random words, such as "blue-door-sea-walnut", is both memorable and far more resistant. Aim for at least 14 characters.
What to avoid
- Your birth date, phone number, or the name of your child or pet
- Common passwords like 123456, qwerty or password123
- An old password with a number tacked on (John2025, John2026)
- Using the same password on more than one account
Use a different password for every account
When a website's database leaks, attackers try the same email and password on other sites. If every password is different, one stolen account does not affect the others. At the very least, keep your email, banking and shopping accounts separate from one another.
Use a password manager
Memorizing dozens of different passwords is not realistic. Password managers (Bitwarden, 1Password, or your browser's built-in manager) keep your passwords in an encrypted vault. You only need to remember one strong master password.
Turn on two-step verification
Even if your password is stolen, the second step still protects the account. Turn it on first for your email, banking and social media accounts. Prefer authenticator apps (Google Authenticator, Microsoft Authenticator), which are safer than SMS codes.
Never share your verification code with anyone, no matter who they say they are. That includes people claiming to call from your bank, a courier company or tech support.
Let's secure your accounts together
We can set up a password manager and two-step verification with you step by step, by sharing your screen.
Get support