Passwords are the locks on every account you own. Most people treat them like padlocks from a dollar store — convenient, identical, and easy to pick. This guide will walk you through fixing your entire password situation using tools that are free and take under an hour to set up.
The Three Password Mistakes Most People Make
Using the same password on multiple sites. When one site is breached, attackers try that email/password combination on every major service — banking, email, social media. This is called credential stuffing and it works.
Passwords based on names, dates, words, or predictable patterns. "Password123!", "Summer2024", "JohnSmith1985" — modern cracking tools guess billions of variations per second.
Even a strong, unique password can be phished or stolen in a breach. Without 2FA, a stolen password is immediately usable. With 2FA, attackers also need your phone or authenticator app.
What Makes a Password Strong?
The single most important factor is length. Here is why:
- An 8-character password with mixed characters: crackable in under an hour with modern hardware
- A 12-character password: crackable in weeks to months
- A 16-character random password: estimated centuries to crack
- A 20+ character random password: effectively uncrackable by any current or near-future technology
- Unique for every account. Every single one — no exceptions for "unimportant" accounts.
- At least 16 characters. Length beats complexity. "correct horse battery staple" is stronger than "P@ssw0rd".
- Random, not memorable. If you can remember it without trying, it is probably guessable. Let your password manager generate it.
- Never based on personal information. No birthdays, names, addresses, pet names, or anything findable on social media.
- Change only when compromised. The old advice to change passwords every 90 days is outdated and counterproductive — it leads to weak, predictable passwords. Change when you suspect compromise.
Set Up a Password Manager (30 Minutes)
A password manager generates, stores, and fills unique passwords for every site automatically. You only need to remember one strong master password.
- Choose a manager: Bitwarden (free, open-source) or 1Password ($3/month) are both excellent. See our full comparison guide.
- Install the app on your phone and the browser extension on your computer
- Create a strong master password: Use a passphrase — 4-5 random words strung together. "correct-horse-battery-staple-moon" is memorable and strong.
- Import existing passwords from your browser (Chrome, Firefox, Safari can all export passwords)
- Change your top 5 most important accounts to manager-generated passwords first: email, banking, social media, work accounts, Apple/Google ID
- Gradually update remaining accounts as you log in to them
Two-Factor Authentication
2FA requires a second proof of identity beyond your password. Even if your password is stolen, attackers cannot log in without your 2FA device.
- Hardware security key (YubiKey, Google Titan) — phishing-proof. Best for high-value accounts.
- Authenticator app (Authy, Google Authenticator, 1Password) — generates 6-digit codes every 30 seconds. Much better than SMS.
- SMS text message — better than nothing, but vulnerable to SIM swap attacks. Avoid for critical accounts.
Enable 2FA on at minimum: email, banking, social media, your password manager, and work accounts. See our best 2FA apps guide.
Check If You Have Been Breached
Go to haveibeenpwned.com and enter your email address. It will show you which data breaches have exposed your email. If you find breaches, change those passwords immediately and anywhere you reused them.
Related Guides
Frequently Asked Questions
How long does a strong password need to be?
Length is more important than complexity. A 16-character password using only lowercase letters is stronger than an 8-character password mixing letters, numbers, and symbols. Modern password cracking uses GPUs that can try billions of guesses per second — but even fast hardware cannot crack a long random password in any reasonable timeframe. Use your password manager to generate 20+ character random passwords.
What is the best password manager?
For most people: Bitwarden (free, open-source, independently audited) or 1Password (paid, excellent UX, family plans available). Both are cross-platform, fill passwords automatically, and generate strong unique passwords. See our full comparison: Best Password Managers 2026.
Are password managers safe?
Yes — the major password managers (1Password, Bitwarden, Dashlane) use zero-knowledge encryption: they never see your master password, and your vault is encrypted before it leaves your device. Even if a password manager is breached (as LastPass was in 2022), attackers only get encrypted data they cannot read without your master password. A password manager is far safer than reusing weak passwords.
What should I do if my password is in a data breach?
Change it immediately on the breached service, and change it on any other service where you used the same password (this is why you should never reuse passwords). Check haveibeenpwned.com to see if your email appears in known breaches. Enable two-factor authentication on the breached account and any accounts with the same password.