🎯 In 30 seconds: Use a password manager so every account gets its own long password. Turn on passkeys where offered, and an authenticator app or security key where they aren’t. Text-message codes are better than nothing but the weakest option. Secure your email first, because it can reset everything else.
Why reuse is the real problem
Most account break-ins don’t involve guessing. A site you used years ago leaks its password list, and criminals try those email and password pairs on banks, shops and email providers. If you reused the password, they are in. A unique password for every site means one leak stays one leak.
Passwords that hold up
- Length beats complexity. The US standards body NIST, in its current digital identity guidance (SP 800-63B-4), sets a 15-character minimum for a password used on its own, and tells sites not to force mixed character types or routine password changes.
- Passphrases are four to seven unrelated words, such as lantern orbit pickle seventeen canoe. Easy to type, long enough to resist guessing. Use them for the few passwords you must remember: the password manager, your computer and your email.
- A password manager creates and fills a random password for everything else. Built-in options (Apple Passwords, Google Password Manager) and free or low-cost standalone managers all work. Protect the manager itself with a strong passphrase and two-step login.
Two-step login, from strongest to weakest
| Method | How it works | Weak spot |
|---|---|---|
| Passkey | Replaces the password. You approve with your phone or computer unlock (face, fingerprint, PIN). There is no secret to type, so a fake site has nothing to steal. | Account recovery if you lose every device; keep a backup method. |
| Security key | A small USB or NFC key you tap. CISA rates it the best protection against phishing. | Buy two and register both, in case you lose one. |
| Authenticator app | A code that changes every 30 seconds, or a prompt where you match a number on screen. | A convincing fake site can still ask you to type the code. |
| Text or email code | A code sent to your phone number or inbox. | CISA calls this the weakest. A SIM swap sends your texts to a thief. |
Check whether you were in a breach
Have I Been Pwned (haveibeenpwned.com) is a free service that shows which known breaches included your email address, and can email you when a new one does. Its Pwned Passwords check is built into some password managers to flag passwords already seen in breaches. Many managers also flag reused and weak passwords, which is your fix-it list.
The order to secure accounts
- Email. Every “forgot password” link lands here.
- Your phone carrier account. Add a port-out PIN or number lock (see the phone safety page).
- Banks, cards, brokerages and payment apps.
- The password manager and your Apple, Google or Microsoft account.
- Tax, Social Security and other government logins.
- Shopping and social accounts.
A worked example: one evening, one household
Two adults, about 120 saved logins between them. Evening one, 90 minutes: install a password manager, set a five-word passphrase for it, turn on two-step login, import saved browser passwords. The manager flags 34 reused passwords.
Then work the list in order: the two email accounts (passkey or authenticator app, new passwords, save recovery codes), then the 9 financial accounts. That covers the accounts that can reset or move everything else. The remaining reused passwords get fixed ten a week; in about three weeks the reuse count is zero.
Already hit? The Money Theft & Forensics page has the recovery steps.