Passwords and MFA
A password is a key. If one key opens every door, losing it once loses everything. Two habits fix most password risk: make each password long and unique, and add a second step.
Make passwords long and unique
Length matters more than symbols. A passphrase of four or five random words is both easy to remember and hard to guess. The bigger rule is never reuse a password across sites. When one site is breached, attackers try that same email and password everywhere else; this is called credential stuffing.
Because no one can remember dozens of unique passphrases, use a password manager. It creates and stores strong passwords and fills them in for you. You remember one strong master passphrase; it remembers the rest.
Turn on MFA everywhere it is offered
Multi-factor authentication (MFA) adds a second proof that it is really you: a code from an app, a tap on your phone, or a hardware key. Even if someone steals your password, they still cannot get in without the second factor.
- Best: a hardware security key or a passkey.
- Good: an authenticator app that generates codes.
- Weakest but still worth it: codes by text message.
Watch for MFA fatigue
Attackers who already have your password may spam you with approval prompts hoping you tap "approve" to make it stop. Never approve a prompt you did not start. If prompts arrive out of nowhere, deny them and change your password.
Quick rules
- One unique passphrase per account, stored in a password manager.
- MFA on email, banking, and work accounts at minimum.
- Approve a login only when you just tried to log in yourself.