Most advice about passwords is either too complicated or out of date. Here is what actually matters, in order.
1. Make every password unique
The biggest risk is not a weak password, it is a reused one. When one website is breached, attackers try the same email and password on banks, email and shops. A unique password for every account contains the damage to one site. A password manager makes this realistic, because it remembers them all.
2. Make them long, not clever
Length beats complexity. A long random password is far harder to guess than a short one with symbols. Let your password manager generate random passwords of 16 characters or more, and let it fill them in. You never need to read or type them.
3. Use a passphrase for the one you must remember
You will type your master password and a few others. For these, use a passphrase: several unrelated words. The strength comes from how many random choices there are:
- 4 random words from a 7,776-word list is about 51 bits of randomness.
- 5 words is about 65 bits.
- 6 words is about 77 bits, which is well beyond practical guessing.
The words must be chosen randomly (dice, or a generator), not picked from a song or a sentence you like. Add a separator you will remember. For example: candle-orbit-tractor-lemon-quiet-ferry (do not use this one).
4. Add a second lock (2FA)
Turn on two-factor authentication wherever it is offered. A stolen password is then not enough. An authenticator code, or better a passkey, is much stronger than an SMS code. NettForge can hold your 2FA codes next to each login. See what is a passkey.
5. Do not change passwords on a schedule
Modern guidance (for example from NIST) is to change a password when there is a reason, such as a breach, and to check new passwords against lists of known leaked ones. Regular forced changes make people choose weaker, predictable passwords.
6. Check what you already have
You probably have old, weak or reused passwords. NettForge's Security score checks your vault on your device and lists what to fix first. Breach checks send only a short fragment of a one-way code, never the password itself.
A simple plan for today
- Choose a long passphrase as your master password and write it down somewhere safe at home.
- Let your manager generate unique passwords for your email, banking and shopping accounts first.
- Turn on 2FA for those same accounts.
- Work through the Security score's suggestions over the next week.
New to all this? Start free, and read how a zero-knowledge manager keeps your vault private.
Questions people ask
For accounts you protect with a password manager, 16 characters or more of random characters is easy because you never type it. For your master password, which you do type, use a passphrase of at least five or six random words.
Current guidance from standards bodies such as NIST is to change a password when you have a reason to (a breach, a suspected leak), not on a calendar. Forced regular changes tend to produce weaker passwords.
A passphrase of five or six words chosen at random from a large list is very strong, and much easier to remember. The words must be random, not a quote or a lyric.