Password Hygiene That Actually Works
Unique secrets, managers, and MFA—practical habits that stop credential stuffing.
Strong passwords remain one of the most practical defenses against account takeover, yet many people still reuse short phrases across banking, email, and shopping sites. Attackers no longer guess one site at a time; they buy credential dumps and try those combinations everywhere. That means a password stolen from a forgotten forum can unlock your primary mailbox years later.
Start by treating your email password as crown jewels. If that inbox falls, password resets for nearly every other service become trivial. Use a unique passphrase of at least four unrelated words plus numbers or symbols, or better, let a password manager generate and store long random strings. Managers also reduce phishing risk because they fill credentials only on the real domain.
Enable multi-factor authentication (MFA) wherever available, preferring authenticator apps or hardware keys over SMS. SMS can be hijacked through SIM swaps. When a service offers passkeys, enroll them—they resist phishing by binding login to the genuine origin.
Review recovery options. Outdated phone numbers and secondary emails are quiet back doors. Remove unused OAuth connections that still hold access. Periodically check breach notices, but assume any password you typed on the open web may already be circulating.
On shared or public computers, never save passwords in the browser profile, and always sign out. At home, keep the manager vault locked with a strong master passphrase you do not reuse elsewhere. Consider a printed emergency sheet stored offline for family recovery.
Organizations should ban password reuse via SSO, enforce MFA on privileged roles, and rotate credentials after contractor offboarding. Combine technical controls with short drills so people recognize unexpected login alerts. Password hygiene is not glamorous, but paired with MFA and a manager it stops a huge share of real-world intrusions without buying exotic tools.