The biggest password risk is not a weak password — it is the same password used everywhere. When one site is breached, attackers try that password on your email, bank and social accounts within hours.
The fix is simple: one unique password per account, and a password manager to remember them for you.
Step 1: Protect the email account first
Your email is the master key — every 'forgot password' link goes there. Give it a long, unique password that is used nowhere else, and turn on two-factor authentication. Do this before anything else.
Step 2: Start using a password manager
A password manager creates and remembers a different strong password for every site; you only remember one master password. Good free options include Bitwarden and the managers built into iPhone (Passwords app), Android (Google Password Manager) and browsers.
Write the master password on paper and keep it somewhere safe at home — it is the only one you must never lose.
Step 3: Fix the important accounts
You do not need to change everything today. Start with email, banking, shopping sites with saved cards, and social media. Change each to a unique generated password. The rest can be updated gradually as you use them.
Step 4: Check for known leaks
Visit haveibeenpwned.com and enter your email address. It shows which known breaches include your address. Any password that appears there must be changed everywhere it was used.
What makes a password strong
- Length beats complexity: a 16-character phrase is stronger than a short one with symbols.
- Never use names, birthdays, pets or football teams — these are tried first.
- A password manager's generated passwords are stronger than anything you will invent.
- Never share passwords by email or message, and no real company will ever ask for yours.
One evening of setup protects you for years. If choosing and setting up a password manager feels like a lot, bring it to a Digital Checkup and we will do it together, step by step.