Stop memorizing passwords: let a password manager remember them
Strong passwords are long, random and different for every account, which no one can memorize. A password manager, two step verification and passkeys do the hard part for you.
The hint
Stop trying to remember your passwords. Remember one strong password instead, for a password manager, and let it create and fill in a different long, random password for every other account. Then add two step verification or a passkey to the accounts that matter most.
Why memory loses
A strong password is long, random and unique. The US Cybersecurity and Infrastructure Security Agency (CISA) recommends at least 16 characters and a different password for each account. Most people have dozens of accounts. Nobody can memorize dozens of long random strings, so people do what humans do: they reuse a favorite password or make small, predictable changes to it.
That is the real danger. When one website is breached, criminals try the leaked email and password on banks, email providers and shops. One reused password can open many doors. You can check whether your email was in a breach in a minute.
How to make the one password you remember
CISA describes two ways to make a password random enough:
- A random mix of upper and lower case letters, numbers and symbols.
- A passphrase of 4 to 7 unrelated words. Four random words strung together are easier to remember and still long.
Use the passphrase method for your password manager's master password. Do not use song lyrics, quotes, names or dates, because those are guessable.
NIST, the US standards body, puts the emphasis on length rather than odd character rules, and its current guidance tells organizations not to force people to change passwords on a schedule. Change a password when there is a reason, such as a breach.
Set up a password manager in four steps
- Pick one. Your phone and browser already have one built in, and CISA notes that free built in browser managers are an option alongside paid programs. What matters most is using it every time.
- Create your master password with the passphrase method above. Write it on paper and keep it somewhere safe at home until it sticks.
- Turn on two step verification for the password manager itself.
- Change passwords as you go. Each time you sign in somewhere, let the manager generate a new random password and save it. Start with your email and bank.
Add a second lock: two step verification and passkeys
Two step verification means signing in needs something besides your password, usually a code from an authenticator app or a prompt on your phone. Even if someone steals your password, they are stuck at the second step. Authenticator apps are a safer choice than text message codes where a service offers both.
Passkeys go further. They replace the password with a key that stays on your device and is unlocked with your face, fingerprint or PIN, so there is nothing to type into a fake website. Our step by step guide shows how to switch your most important accounts to passkeys.
Common mistakes
- Reusing your master password anywhere else. It must be unique.
- Saving passwords in a note or spreadsheet. CISA advises against writing them down or keeping them in a file on your computer.
- Skipping two step verification on email. Your email can reset every other password you own.
- Typing a password because a message asked you to. Banks and tech support do not ask for your password. Hang up or close the message and go to the site yourself. Learn how to spot a phishing email or text.
Try it this week
Set up your password manager today and change three passwords: email, bank, and the account you reuse most. Add two step verification or a passkey to your email. That hour of work protects you more than any password you could ever memorize.
Frequently asked questions
What makes a password strong?
Length and randomness. CISA recommends at least 16 characters, either a random mix of letters, numbers and symbols or a passphrase of 4 to 7 unrelated words, and a different password for every account.
Is it safe to keep all my passwords in one place?
For most people it is far safer than reusing passwords. A reputable password manager encrypts your vault, and you protect it with one strong master password plus two step verification.
Are the password managers built into browsers and phones good enough?
Yes, for most people. CISA lists free built in browser password managers alongside paid programs. What matters most is that you use one consistently.
Do I still need passwords if I use passkeys?
For now, yes. Many sites do not support passkeys yet, so keep a password manager for those. Add passkeys to your most important accounts as they become available.
Should I change my passwords every few months?
No, not on a schedule. NIST's current guidance tells organizations not to force regular changes. Change a password when there is a reason, such as a data breach.