Passwords and a manager

A password does two jobs: it keeps one account closed, and, if it is reused, it opens every other account the moment one of them leaks. This lesson fixes the second problem first.

Length beats cleverness

A long password made of four unrelated words is harder to guess than a short one full of symbols, and far easier to type. "Copper lantern thursday orbit" is a better password than "P@ssw0rd!23". The aim is at least sixteen characters.

The real risk is not a weak password but a reused one. When a website leaks its list, the same email and password are tried everywhere within hours.

A password manager, in twenty minutes

A password manager is an app that stores a different long password for every account and fills it in for you. You remember one strong passphrase; it remembers the rest. Install one on your phone and computer, set that single passphrase, and switch on its backup.

Then change the passwords on your three most important accounts: email first, because it resets everything else, then the account you use to pay for things, then the account you sign in with most often. Let the manager generate each new one. Do the rest over the coming weeks, as you sign in.

Email is the master key

Whoever controls your email can reset almost every other password you have. Give it the longest passphrase, and in lesson 2 give it two-step sign-in before anything else.