Passwords & Passkeys
Your accounts contain valuable personal information. Learn how to protect them with stronger passwords, password managers, passkeys and multifactor authentication.
Why account security matters.
Your email account, social media, shopping accounts and cloud storage can all contain sensitive information.
If someone gains access to your email account, they may also be able to reset passwords for other services connected to it.
Your primary email account is particularly important. Give it a unique password or passkey and enable multifactor authentication.
What makes a strong password?
A strong password should be difficult to guess and unique to each account.
When you need to remember a password yourself, a long passphrase made from randomly selected words can be easier to remember.
orbit-cactus-river-lantern
Never use a published example as your real password. Generate your own unpredictable passphrase.
Stop trying to remember everything.
A password manager stores your credentials and can generate long, unique passwords for individual accounts.
Generates and stores unique passwords
Each account gets different credentials
One breached password cannot directly unlock all your other accounts
Protect your password manager with a strong master password and MFA where supported.
Understand your password manager's recovery process. Some services cannot recover your vault if you lose your master password and recovery methods.
What if you didn't need a password?
Passkeys use public-key cryptography. Your device or passkey provider holds a private key, while the website stores the corresponding public key.
Safely holds your private key
Verifies authentication using your public key
You normally unlock a passkey using your device's screen lock, fingerprint or facial recognition.
Unlike ordinary passwords, passkeys are designed to resist phishing because authentication is bound to the legitimate website or application.
Your fingerprint or face is generally used locally to unlock the passkey. Your biometric information is not sent to the website as your password.
Understanding MFA.
Multifactor authentication requires additional proof of identity beyond a password.
Prefer phishing-resistant authentication, such as supported passkeys or FIDO2 security keys, where available.
Legitimate support staff should not ask you to disclose your MFA codes. Never approve an unexpected sign-in request.
Don't forget your recovery options.
Strong account protection is only useful if you can still regain access when your phone is lost or replaced.
Never upload recovery codes to public storage or share them with someone claiming to provide technical support.
What happens if your password leaks?
Websites sometimes suffer data breaches. Attackers may obtain email addresses, password hashes and other account information.
If you've reused a password, attackers may try it against your other accounts. This is called credential stuffing.
Change the affected password, replace reused credentials on other accounts, review active sessions and enable MFA.
You can check whether your email address appears in known breaches using Have I Been Pwned.
A clean result doesn't guarantee that your credentials have never been exposed.
Five things you can do today.
Spotting phishing.
Next we'll examine suspicious emails, fraudulent messages and fake websites, including how attackers try to steal passwords and verification codes.