Password Security Best Practices

The Current Threat Landscape

Password-based attacks are more sophisticated than ever. Modern attackers use AI-assisted cracking, credential stuffing from billions of leaked records, phishing, and social engineering — often in combination. Understanding these threats helps you defend against them effectively.

The good news: following a few core practices eliminates the vast majority of risk from all of these attack types.

Practice 1: Use Long, Random, Unique Passwords

The foundation of password security is using passwords that are:

• Long — minimum 16 characters; 24+ for critical accounts
• Random — generated by a cryptographically secure tool, not chosen by a human
• Unique — never reused across accounts

If this sounds like a lot to manage manually, it is — which is why practice 2 is essential.

Practice 2: Use a Password Manager

A password manager is the single most impactful security improvement most people can make. It:

• Generates strong, random passwords automatically
• Stores them encrypted (only you hold the key)
• Autofills credentials, reducing phishing risk (it only fills on the correct domain)
• Alerts you to leaked or reused passwords

Recommended options: Bitwarden (open source, free), 1Password, Dashlane, or your browser's built-in manager as a starting point.

Your password manager master password is the one password you must both memorize and make exceptionally strong. Consider a 6–8 word passphrase for this purpose.

Practice 3: Enable Two-Factor Authentication (2FA)

2FA adds a second verification step beyond your password — typically a time-based code from an app or a hardware key. Even if your password is stolen, an attacker cannot access your account without the second factor.

2FA methods ranked by security:

1. Hardware security keys (YubiKey) — phishing-proof, strongest option
2. Authenticator apps (Google Authenticator, Authy, Aegis) — very strong
3. SMS codes — better than nothing, but vulnerable to SIM-swapping

At minimum, enable authenticator-based 2FA on your email, banking, and any account that stores sensitive information. Passkeys (available on major platforms) are an even stronger replacement for passwords + 2FA combined.

Practice 4: Know When You've Been Breached

Data breaches happen constantly. Knowing when your credentials are exposed allows you to act before attackers do.

• Monitor your email addresses at haveibeenpwned.com
• Most password managers (and browsers) have built-in breach monitoring
• If a service you use announces a breach, change your password immediately

Since you're using unique passwords, a breach at one service only requires changing that one password — not all of them.

Practice 5: Recognize Phishing Attacks

Phishing — tricking you into entering credentials on a fake website — is responsible for a huge proportion of account compromises. Signs of a phishing attempt:

• Email with urgent language ("Your account will be suspended")
• Sender email address doesn't match the organization
• Link goes to a slightly misspelled domain (paypa1.com vs paypal.com)
• Unsolicited requests for credentials or personal information

Password managers help here: they will not autofill credentials on a fake domain, providing a natural warning that something is wrong.

Practice 6: Secure Your Email Account Above All Else

Your email is the master key to most of your accounts — password reset emails go there. If an attacker controls your email, they can reset the passwords of any account linked to it.

Treat your email account as your most critical asset:

• Use a unique, very long password (20+ characters)
• Enable hardware key or authenticator 2FA
• Use a reputable provider with strong security (Gmail, Proton Mail, Fastmail)
• Set up account recovery options (backup codes, recovery email)

Practice 7: Keep Software and Devices Updated

Even the strongest password doesn't help if your device is compromised by malware. Keyloggers and info-stealers capture credentials regardless of password strength.

• Enable automatic OS and application updates
• Use reputable antivirus/endpoint protection on Windows
• Be cautious about software you install and browser extensions you grant access to

Practice 8: Use Different Email Addresses for Different Purposes

Consider using separate email addresses for:

• High-security accounts: banking, investment, healthcare — keep this address private
• General accounts: shopping, subscriptions, social media
• Throwaway: newsletter signups, one-time uses

Services like Apple's Hide My Email or SimpleLogin let you create unlimited alias addresses that forward to your real inbox, protecting your primary email from exposure.

Quick-Reference Checklist

• ✓ All passwords 16+ characters, mixed character types
• ✓ Password manager installed and actively used
• ✓ 2FA enabled on email, banking, and critical accounts
• ✓ Email monitored for breaches (HIBP or password manager alerts)
• ✓ OS and applications kept up to date
• ✓ Phishing awareness: verify domains before entering credentials