Passwords and Two-Step Sign-In

Introduction

A password is the key to your account. Weak keys are easy to guess, and a key that opens many doors is a disaster if one copy is stolen. This lesson shows a simple, realistic way to do better.

The simple explanation

Use a long, different password for every account, and add a second step to sign in.

What makes a password strong

• Length matters most. A long passphrase made of several random words is stronger and easier to remember than a short, tricky one.
• Make it unique. Use a different password for each account.
• Avoid personal facts such as your name, birthday, pet or favourite team.
• Skip the common ones such as 123456 or password.

Example of a good style (do not use this one): four unrelated words joined together, like bridge-lemon-orbit-candle.

Why reusing passwords is dangerous

Websites sometimes get hacked and their password lists leak. Criminals then try the same email and password on many other sites. This is called credential stuffing. If you reuse a password, one leak can open all your accounts.

Use a password manager

Nobody can remember dozens of long, unique passwords. A password manager creates them, stores them in an encrypted vault and fills them in for you. You only remember one strong master password. Many browsers and phones include one.

Two-step sign-in

Two-step sign-in (also called two-factor authentication or MFA) asks for something more than your password, such as a code from an app or a security key. Even if someone learns your password, they are still blocked.

From stronger to weaker, common options are:

1. Passkeys and security keys, which are very hard to trick.
2. Authenticator app codes, which change every 30 seconds.
3. Text message codes, which are better than nothing but can be intercepted or tricked.

Turn it on first for your email, banking and anything with payment details. Never share a code with anyone who contacts you. A real company will not ask for it.

Try it yourself

Pick your email account. Check its security settings and turn on two-step sign-in. If you do not use a password manager yet, look at the one built into your browser or phone.

Summary

• Long, unique passwords or passphrases beat short, complex ones.
• A password manager makes unique passwords practical.
• Two-step sign-in blocks most account takeovers, and keys or apps are stronger than text codes.