Long and unique beats clever and complex. Three habits cover most of the risk.
1. One password per account
When a site leaks passwords, attackers try the same login on other sites. Unique passwords stop that chain.
2. Use a password manager
Nobody can remember dozens of unique passwords. A manager creates and fills them for you, so you only remember one strong passphrase: four or more random words work well.
3. Add two-step verification
Turn it on for email first, since email can reset every other account. Prefer an authenticator app or a security key over SMS where the service offers it.
Do this today
- Change your email password to a new passphrase
- Turn on two-step verification for email
- Save the recovery codes somewhere offline
