How to Create Strong Passwords and Use Passkeys

What makes a password strong

Length beats complexity. A long password made of ordinary words is far harder to crack than a short one with symbols. Security experts now recommend passphrases: four or more random words strung together, like correct horse battery staple. Aim for at least 14 characters, and never reuse a password across sites: one breached site should never unlock your email, bank, and social accounts.

Step 1: Get a password manager

1. Install a reputable password manager. Bitwarden is free, open source, and works on every platform; Apple and Google also include capable built-in managers (iCloud Keychain, Google Password Manager).
2. Create one strong master passphrase and write it on paper stored somewhere safe. This is the only password you must memorize.
3. Let the manager generate a unique random password for every site from now on. You will never type them yourself.
4. Turn on the manager's browser extension and phone autofill so logins fill in with one tap.

Step 2: Turn on two-factor authentication (2FA)

1. For your email, bank, and social accounts, open security settings and enable two-step verification.
2. Prefer an authenticator app (like Google Authenticator or the one in your password manager) over SMS codes, which can be intercepted.
3. Save the backup or recovery codes the site shows you. Without them, a lost phone can lock you out.

Step 3: Start using passkeys

Passkeys are the modern replacement for passwords. Instead of typing a secret, you unlock with your fingerprint, face, or device PIN. There is nothing to phish, nothing to leak in a breach, and nothing to remember. Google, Apple, and Microsoft all support them.

1. On a site that offers passkeys (Google, Apple, PayPal, eBay, and many banks), go to security settings and choose Create a passkey.
2. Confirm with your fingerprint, face, or PIN. The passkey is saved in your device's password manager and syncs across your devices (iCloud Keychain on Apple, Google Password Manager on Android/Chrome).
3. Next time you sign in, choose the passkey option and unlock with biometrics. No password needed.

If you switch phones

Passkeys synced through iCloud Keychain or Google Password Manager move with your account, so signing into the new phone restores them. Authenticator app codes need separate attention: export or transfer them before wiping the old phone, or you will be locked out of 2FA-protected accounts.

Passwords to change first

• Email first. Your email resets everything else, so it gets the strongest unique password and 2FA.
• Banking, payment apps, and anything holding your money.
• Social accounts, which are prime targets for impersonation scams.
• Any password you have reused on more than one site.