Passwords and MFA

Start with the password

Your password is the lock on your account. If it is short or reused, that lock is easy to pick. Getting a few habits right here does more for your safety than almost anything else. Logging in is how you prove who you are, a step called authentication, and a strong password is the first part of it.

Long and unique beats complicated

For years people were told to build passwords from a capital letter, a number and a symbol. The trick that actually helps is simpler: make them long, and make each one different.

• Length matters more than odd symbols. A phrase of four or five random words is both long and easier to remember than "P@ss1!".
• Every account gets its own password. If one site is breached, a reused password hands the attacker your other accounts too.
• Never build a password from something public, like your name, your team or your birth year.

A short example: "correct-harbour-lamp-tuesday" is far harder to crack than "Blerta2024", and you only have to type it, not decode it.

Let a password manager do the remembering

No one can remember a different long password for every account. That is what a password manager is for. It is an app that keeps all your passwords in one encrypted vault and fills them in for you. You remember one strong master password; it remembers the rest.

• It can generate a fresh random password for each new account.
• It only fills a password on the real site, so it quietly helps against fake look-alike pages.

Pick one, protect it with a strong master password and the extra login step described in the next section, and let it carry the load.

MFA: a second lock on the door

A password can be guessed, stolen or phished. Multi-factor authentication (MFA) adds a second step, so a password alone is not enough to get in. After your password, you confirm with something else: a code from an app, a tap on your phone, or a hardware key.

Turn it on wherever it is offered, starting with your email. Your email is the master key: if someone controls it, they can reset the password on almost everything else.

The one code you never share, and the prompt you never approve

Attackers know MFA works, so they try to trick you into handing over the second step.

• A one-time code is for you to type, never to read out. No real bank, company or IT team will ever phone and ask you to tell them the code. If someone does, it is a scam.
• Approve only a prompt you started. If your phone buzzes asking you to approve a login you did not just begin, say no. It usually means someone has your password and is knocking on the door.

If you ever confirm one of these by mistake, change that password and tell whoever handles IT or security. Doing that early keeps a small slip from becoming a real break-in.

Check yourself