What makes a strong password?

A strong password is at least 16 characters long, uses a mix of uppercase, lowercase, numbers, and symbols, and is unique for every account. The best approach is to use a password manager that generates and stores complex passwords for you.

Should I use a password manager?

Yes. Password managers are the single most effective tool for personal cybersecurity. They generate unique, complex passwords for every account, auto-fill login forms securely, and alert you to compromised credentials. Popular options include 1Password, Bitwarden, and Dashlane.

How often should I change my passwords?

Change passwords immediately if a service you use reports a breach. Otherwise, focus on making passwords unique and strong rather than changing them frequently. Enable multi-factor authentication on every account that supports it.

Password & Authentication Checklist — You're Already a Target

🔑 Passwords are dead. Replace them with a password manager and multi-factor authentication.

🔒 Set Up Password Manager

Let a password manager generate and store unique passwords for every account. This is the foundation of strong authentication.

Install a password manager (1Password, Bitwarden, or Dashlane)Choose one and commit. 1Password is most user-friendly. Bitwarden is open-source and affordable. Dashlane is comprehensive. Pick one and stick with it. Create a strong master passwordThis is the ONE password you'll memorize. Make it 16+ characters with uppercase, lowercase, numbers, and symbols. Write it down and store it somewhere secure. Enable multi-device sync in your password managerYour passwords should be accessible on your phone, laptop, and tablet. Make sure sync is working across all your devices. Generate unique passwords for all accountsUse the password manager's generator (20+ characters, random). Never reuse passwords across accounts. Let the manager fill them in automatically. Set a recurring reminder to update passwords every 6 monthsWhile you don't need to change passwords constantly, updating them every 6 months is a good practice. Let your password manager handle the heavy lifting.

🔑 Enable Multi-Factor Authentication (MFA)

Add a second layer of protection. Even if your password is compromised, attackers can't get in without your second factor.

Enable app-based MFA on your primary email accountEmail is the master key to everything. Use Google Authenticator, Microsoft Authenticator, or Authy. NOT SMS. App-based codes can't be intercepted like SMS texts. Enable app-based MFA on all banking and financial accountsMost banks now support authenticator apps. Enable this immediately. Your money depends on it. Enable app-based MFA on social media accountsFacebook, Instagram, Twitter, LinkedIn, TikTok—all support authenticator apps. Protect your reputation and identity. Disable SMS-based two-factor authenticationSIM swapping attacks let criminals intercept SMS codes. Turn off SMS 2FA wherever possible. Use app-based codes instead. Save recovery codes for all MFA-protected accountsIf you lose access to your authenticator app, recovery codes let you regain access. Store these in your password manager. Treat them like passwords.

🔏 Hardware Security Keys

For your highest-value accounts, add the most secure authentication possible: physical hardware keys.

Research and consider buying a hardware security key (YubiKey)A YubiKey is a small physical device that stores cryptographic keys. You insert it or tap it to authenticate. Phishing-proof because it verifies the actual website you're on. Set up hardware key MFA on your primary email accountThis is optional but highly recommended if you've been targeted. Google, Microsoft, and most major providers support YubiKey. Buy backup hardware keysGet two YubiKeys—one for daily use, one as a backup. Keep the backup in a safe place (safe deposit box is ideal).

🧹 Clean Up Old Passwords

Remove the weak passwords your browser has been storing—they're security liabilities.

Delete all saved passwords from your browserChrome, Firefox, Safari, Edge—they all have password managers. Go to settings and delete every saved password. Anyone with access to your computer can see them. Disable browser password savingIn your browser settings, turn off "offer to save passwords." You'll use your password manager instead. Clear browser autofill dataBrowser autofill stores sensitive information. Clear your autofill data regularly or disable it entirely.

This checklist is from You're Already a Target by Corey White.

Haven't taken the assessment yet?

Take the Security Scorecard → Back to Master Checklist →