Strong passwords and password managers, without the jargon

The three rules

CISA, the US government's cybersecurity agency, puts it in three words: long, random, unique.

• Long. At least 16 characters. Longer is stronger. The FTC's minimum is 12.
• Random. Either a jumble of letters, numbers and symbols, or a passphrase: four to seven unrelated words, such as HorsePurpleHatRunBay. Not a song lyric, not a quote, not your pet's name.
• Unique. A different password for every account. The FTC explains why: hackers who get a password from one site try it on your other accounts.

Steps

1. Start with your email password. Password reset links for your other accounts go to your email, so it protects everything else. Make it a long passphrase you have never used anywhere.
2. Pick a password manager. A password manager is a program that creates, stores and fills in your passwords. You remember one strong password, the one for the manager itself. Your web browser has one built in, or you can choose a separate program; look for independent expert evaluations before you pick.
3. Let it create new passwords. As you sign in to each account over the next few weeks, use the manager's “generate password” button and save the result. Start with banking, shopping and anything that holds a card number.
4. Stop reusing. The manager will point out passwords that are weak or used more than once. Replace those first.
5. Turn on two-step verification for email and banking. Even a strong password can be stolen. See turn on two-step verification.
6. Change a password when there is a reason. If a company tells you it was breached, or you typed the password into a page you no longer trust, change it that day.

Things you can stop doing

The US standards body NIST now tells websites not to force a mixture of character types and not to make people change passwords on a schedule; a change should be required when there is evidence the password was exposed. It also tells them to allow password managers and pasting. So:

• You don't need to change good passwords every few months.
• You don't need a symbol in a certain position. A longer password does more.
• If a site blocks pasting into the password box, that is the site being behind the times, not you doing something wrong.

If that didn't work

If a site won't accept a long password, use the longest it allows and mix upper and lower case letters, numbers and symbols, as the FTC suggests.