Why this matters
The most common password in the world is still "123456". A weak password is like leaving your front door unlocked. The good news: good password habits are simple once you know them.
The Three Rules of Strong Passwords
Length beats complexity.
A long password (16+ characters) is harder to crack than a short one full of symbols. "I_like_to_eat_nshima_on_Sundays!" is far stronger than "P@ssw0rd!" — and much easier to remember.
Never reuse passwords.
If one site gets hacked and you used the same password everywhere, every account is compromised. Each important account needs its own unique password.
Use a passphrase, not a password.
A passphrase is a string of random words: "correct-horse-battery-staple". It is long enough to be secure and structured enough to remember. Add a number and a symbol if the site requires them.
What to Never Use as a Password
Avoid these at all costs:
- Your name, birthday, or the name of a family member or pet
- Common words: "password", "admin", "letmein", "football"
- Keyboard patterns: "qwerty", "123456", "asdfgh"
- The same password you have used on other sites
- Any password that is shorter than 12 characters
What Is a Password Manager (and Why You Need One)
A password manager is an app that creates, stores, and fills in strong, unique passwords for every site you use. You only need to remember one master password — the manager handles the rest.
Recommended password managers (all have free tiers):
- Bitwarden — free, open-source, works on all devices. The best option for most people.
- Google Password Manager — built into Chrome and Android. Convenient if you are already in the Google ecosystem.
- 1Password — paid, excellent user experience. Worth it for teams.
Two-Factor Authentication (2FA): The Extra Lock
Even a strong password can be stolen. Two-factor authentication adds a second layer: after entering your password, you also enter a code from your phone (or tap a prompt). Even if someone has your password, they cannot get in without your phone.
- Turn on 2FA everywhere you can: email, banking, social media, WhatsApp.
- Use an authenticator app (Google Authenticator, Authy) rather than SMS codes. SMS can be intercepted.
- Save your backup codes — print them and store them somewhere safe. If you lose your phone, these are the only way back in.
Action Plan: 15 Minutes to Better Password Security
- Download Bitwarden (or your password manager of choice) on your phone and computer.
- Set a strong master passphrase — write it down and store it somewhere safe while you memorise it.
- Change the passwords on your three most important accounts: email, banking, and social media.
- Turn on 2FA for your email account — this is the most important one, because access to your email can be used to reset every other password.
- Over the next week, update passwords for other accounts as you use them.