The one idea
The danger is not that your password is weak. It is that it is reused.
A breach at one company becomes a break-in everywhere you used that password. This attack is automated, it costs nothing to run, and it does not require anyone to be interested in you specifically.
Recommendation The fix is not memorising better passwords. Nobody can memorise a hundred
unique ones. The fix is to stop trying — let software generate and remember
them, and memorise exactly one.
Use a different password everywhere, and let a password manager remember them so you do not have to.
Unique credentials per service, generated and stored in a manager, with multifactor authentication on anything that matters.
Credential stuffing exploits reuse across services. Unique per-site credentials contain the blast radius of any single breach to that one service.
What actually makes a password hard to break
Fact CISA recommends passwords of at least 16 characters, or a passphrase of five to
seven unrelated words, stored in a password manager.
Length matters more than complexity. Tr0ub4dor&3 is short and painful to
type. correct-horse-battery-staple-lamp is far longer, far easier to
remember, and much harder to crack.
But here is the thing that makes this lesson short: you only need to be able to remember one password. The one that unlocks your manager. Every other password should be random, long, and something you have never seen.
The afternoon that fixes this
Setting this up once
1 of 6Pick a password manager and install it.
Bitwarden has a free tier that covers unlimited passwords across unlimited devices, and it is open source. KeePassXC is fully offline if you would rather nothing be stored online at all.
Install the browser extension and the phone app. Both, or you will abandon it by Thursday.
Try this
Go to Have I Been Pwned and enter your main email address.
Your challenge
Level 3 · IndependentSecure your three most important accounts properly, today.
For each of email, your primary bank, and one more that matters to you:
- A unique generated password, stored in the manager.
- Multifactor authentication enabled.
- Recovery codes saved somewhere you will find them.
- Recovery email and phone number checked and current.
Then test the recovery path on one of them — actually go through "forgot password" and confirm you can get back in.
Point 4 is where people are caught out. Recovery details often point at a phone number or an email from years ago, and you discover this at the worst possible moment.
What people usually get wrong
- Reusing passwords. The one that actually matters.
- Variations on a theme.
Summer2024!becomingSummer2025!is not a new password to someone holding the old one. - Not saving recovery codes. The single most common way people lock themselves out permanently.
- SMS as the only second factor. Better than nothing, but phone numbers can be hijacked. Prefer an app or a key where offered.
- Personal information in passwords. Names, birthdays and pet names are all discoverable.
- Skipping the phone app. A manager you cannot reach on your phone is one you will stop using.
- Not securing the email account first. It is the master key to everything else.
How someone experienced does it
Experienced people treat their email account as the crown jewels, because it is. Whoever controls your email can reset every other account you own. It gets the strongest password and the strongest second factor.
They also keep recovery codes somewhere physical. A locked drawer is beyond the reach of every remote attacker, and it survives the loss of the phone.
And they run the breach check once or twice a year rather than never, because the answer changes.
When not to use this
Do not put your work credentials in a personal password manager if your employer provides one or prohibits it. Check the policy.
And do not use a password manager built into an account you share with someone else — the whole model assumes one person controls the vault.
Passkeys, and why passwords may eventually go away
A passkey replaces the password with a pair of cryptographic keys. The private key stays on your device, protected by your fingerprint, face or device PIN. The service only ever holds the public key.
Two consequences follow, and both are significant:
- There is nothing useful to steal in a breach. The service never had your secret.
- Phishing largely stops working. The key is bound to the real domain, so a fake site cannot trigger it. This is what "phishing-resistant" means.
Support is growing across major services. Where a service offers a passkey and your device supports it, it is generally a straightforward upgrade — and your password manager can usually store it.
Prove it
By the end of today: a password manager installed on computer and phone, your email secured with a unique password and MFA, and the recovery codes saved where you will actually find them.
Then tell one other person to do it. This is the rare security advice that is genuinely worth passing on, because the attack it prevents is the one that actually happens to ordinary people.
Keep learning this
Paste this into any AI assistant. It turns the assistant into a tutor that tests you instead of just answering you.
Act as an experienced practitioner who is good at teaching. I have just learned password security, password managers and multifactor authentication. Assume I am intelligent but relatively new to this — treat me as beginner level. Work through this in order, and wait for my reply at each step: 1. Ask me 5 questions that test whether I actually understood password security, password managers and multifactor authentication. Do not reveal the answers yet. 2. After I answer, tell me which parts I got right, which I got wrong, and which I only half-understand. Explain only what I misunderstood — do not re-teach what I already know. 3. Give me one practical challenge based on something I could genuinely encounter at work or in daily life. Do not solve it for me. 4. Evaluate my solution the way an experienced person would judge it, including what a professional would have done differently. 5. Tell me what to learn next, and why that comes next. 6. Give me trustworthy sources for deeper study — prefer official documentation, primary research or standards bodies over blogs and videos. Rules for you: no buzzwords. No motivational filler. Say "I'm not certain" when you are not certain, and tell me which parts of your answer I should verify myself. Clearly separate facts from your recommendations and your opinions.
Become independent at this
Use this when you want a path from where you are to actually good, with checkpoints you can test yourself against.
I want to become independently capable at managing accounts and credentials securely — not permanently dependent on AI, tutorials or step-by-step guides. Design a progression for me with five stages: Beginner, Guided practice, Independent practice, Real-world application, Professional level. For each stage tell me: - what I must know - what I must be able to do without help - the mistakes people make at this stage - one practical challenge - one real project that would prove I reached this stage - one way I can test myself honestly Then tell me the signals that I am ready to move to the next stage, and the signals that I have skipped ahead too early. Keep the theory to the minimum I actually need. Focus on ability I can transfer to situations you and I have not discussed.