Why Password Habits Break Down

Most people don't use weak passwords because they don't care about security — they use them because strong passwords are genuinely hard to manage. When every site demands a different combination of letters, numbers, and symbols, the temptation to reuse one "good enough" password everywhere is understandable. But that shortcut creates real risk: when one site gets breached, attackers routinely try the same credentials on banking, email, and shopping accounts.

The sticky note problem is just a symptom. The real issue is that we're trying to hold too many unique, complex strings in memory — something humans aren't built to do. The practices below work because they stop relying on memory alone.

Best Practices for Managing Passwords Well

These approaches are widely recommended by security researchers and used by professionals who manage dozens — or hundreds — of accounts securely.

1

Use a dedicated password manager to store and generate credentials

A password manager creates and stores complex, unique passwords for every account, so you only need to remember one strong master password. This eliminates the trade-off between security and memorability that causes most people to cut corners.

Example: With a password manager installed, logging into your bank takes the same effort as before — but the password itself is a 20-character random string you never had to think up or remember.
2

Build passphrases instead of passwords for accounts you type manually

A passphrase — four or more random, unrelated words strung together — is both longer and easier to remember than a scrambled string of characters. Length is one of the strongest drivers of password strength.

Example: A phrase like "lamp-canyon-biscuit-thunder" is far harder for automated tools to crack than "P@ssw0rd1" and far easier for a person to recall.
3

Never reuse the same password across multiple accounts

When any site you've used suffers a data breach, attackers test those credentials everywhere else automatically. One reused password can compromise accounts you've had for years.

Example: If your streaming service is breached and you used the same password for your email, attackers can access your inbox — and from there, reset nearly every other account you own.
4

Enable two-factor authentication (2FA) on every account that supports it

Two-factor authentication (2FA) requires a second verification step — usually a code sent to your phone or generated by an app — after entering your password. Even if your password is stolen, 2FA typically prevents unauthorized access.

Example: Enabling an authenticator app on your email account means a thief with your password still can't get in without also having your phone.
5

Create a unique, especially strong password for your email account

Your email is the recovery method for almost every other account you own. Compromising it gives attackers a skeleton key to your digital life, so it deserves extra protection above and beyond other accounts.

Example: Use your password manager's generator to create a long, random password specifically for your primary email, and don't reuse it anywhere else.
6

Audit and delete accounts you no longer use

Old, forgotten accounts still hold your data and often use outdated passwords. Closing them reduces the number of places where a breach could expose your credentials or personal information.

Example: A quick search of your inbox for "welcome" or "confirm your email" can surface accounts you signed up for years ago and have long since forgotten.

Start Here: Quick Actions You Can Take Today

You don't need to overhaul everything at once. Even adopting one of these actions this week makes your accounts meaningfully more secure.

high Download a reputable password manager app and import or manually add your three most-used account passwords today.
high Turn on two-factor authentication for your primary email account right now — it usually takes under five minutes.
medium Check your email address at haveibeenpwned.com to see if it has appeared in a known data breach.
high Change any password you're currently using on more than one site to something unique, starting with the most important accounts.

For a broader look at protecting everything connected in your home, see our guide to home device security habits. If you're protecting accounts on the go, securing your devices while traveling covers the specific risks of public Wi-Fi and shared networks.

What Good Password Hygiene Actually Looks Like

Once you have a system in place, maintaining it is mostly about building a few low-effort habits. Set a reminder once or twice a year to review which accounts you've signed up for and whether any are sitting unused. Old accounts with outdated passwords are easy targets.

Check whether any of your email addresses have appeared in known data breaches — services like Have I Been Pwned (haveibeenpwned.com) let you do this for free. If an address appears in a breach, prioritize changing that account's password and enabling two-factor authentication if you haven't already.

SMS Codes vs. Authenticator Apps

Two-factor authentication can work via text message (SMS) or through a dedicated authenticator app. SMS is significantly better than no 2FA at all, but authenticator apps are generally considered more secure because they aren't vulnerable to SIM-swapping attacks. If the accounts you care most about support an authenticator app, it's worth using one.

For smartphone-specific security steps — including lock screen settings and app permissions — the smartphone security basics guide walks through what matters most for non-technical users.