Better Passwords, Passkeys and Account Security

Start with unique credentials and a second layer

Use a different, long password for each account, or a passkey where the service supports it. A reputable password manager can generate and store unique passwords. Add multifactor authentication and protect your recovery options, starting with your email and financial accounts.

Reusing a password creates a chain reaction: if one service is breached, someone may try the same credential elsewhere. A small variation of a familiar password is not a reliable solution. Unique credentials mean a problem at one service is less likely to unlock the others.

Let a password manager do the repetitive work

A password manager stores credentials in a protected vault and can generate long, random passwords. Choose a maintained product with clear security information, keep it updated, and protect the vault with a strong unique master password or the provider’s supported secure access method.

Understand how to recover access before you need to. Store any recovery material safely, and enable multifactor authentication for the manager where supported. Autofill can help reduce typing, but still check the website address. Never follow a suspicious message just because a login page looks familiar.

When you make a password yourself, make it long

Length matters. A long passphrase made from unrelated words can be easier to remember than a short string of predictable substitutions. Avoid names, birthdays, quotations, and details someone could learn from your public profile. Use a different passphrase for every account that requires one.

Changing the final number on an old password does not make it meaningfully unique. Change a password if it has been exposed, reused, or compromised, and follow legitimate service requirements. Do not share a real password in a strength-testing website or send it through a message.

Passkeys are different from passwords

A passkey uses public-key cryptography rather than a shared password. Your device or credential provider keeps the private part, while the service keeps a public part. You typically approve a sign-in with your device’s PIN, fingerprint, or face recognition; those local checks are not a password sent to the website.

Properly implemented passkeys are tied to the intended service, which helps resist phishing. Some sync through a credential provider; others remain on a device or hardware key. Check the service’s options, compatible devices, and recovery process. A passkey does not make an unlocked or compromised device harmless, and older sign-in alternatives may still need protection.

Choose multifactor authentication and save recovery codes

Multifactor authentication combines different types of evidence, such as something you know and something you possess. A password plus a text code is one example. A hardware security key or supported passkey can provide phishing-resistant authentication; not every verification method has the same protection.

If an authenticator app or security key is available, consider it. Text-message codes are generally better than having no second layer, but can face phishing and phone-number takeover risks. Never approve an unexpected sign-in prompt or give a code to someone who calls you.

Recovery codes can restore access when your usual second factor is unavailable. Keep them in a secure location separate from an exposed inbox, and understand whether each is single-use. Confirm your recovery email and phone number are current.

A practical order for securing accounts

Make changes in a quiet session, not while responding to an alarming message. Open the official site or app, check your security settings, and test that you can sign in before removing an old method.