Passwords: Unique, Long, Managed

Every account you own is a door. Most people protect all of them with the same key, then wonder how someone got into the vault. Here is how to fix it, in order of impact.

1. The password is your digital fingerprint

Stop using the same password for everything. This is not a suggestion; it's a non-negotiable law of the digital universe. Using one password is like using the same key for your front door, your car and your bank vault.

Breached sites leak email + password pairs by the billion. Attackers feed those lists into automated credential stuffing tools that try every pair against banks, email providers, cloud storage and social networks. They don't need to crack anything; they just need you to have reused it once.

The solution: use a password manager. It is a one-time mental commitment that solves an infinite problem. It generates a unique random password for every service, so a breach on one site stays on that site. This single habit turns a catastrophic breach into a minor inconvenience.

2. Length beats complexity

P@ssw0rd! passes most "strong password" checks and falls in seconds, because attackers try those substitutions first. What actually resists guessing is randomness × length, measured in bits of entropy:

Every extra bit doubles the attacker's work. Aim for 80+ bits on anything that matters.

For the few passwords you must type or remember (your password manager, your computer login), use a passphrase: several words chosen randomly, not a lyric or quote.

# Bitwarden CLI — 6 random words
bw generate --passphrase --words 6 --separator "-"

# no manager installed yet — 24 random bytes, base64
openssl rand -base64 24

The randomness has to come from a machine or from dice — never from your head. Humans are predictable; wordlists of "random" human choices are what cracking rigs try first.

3. Pick a password manager

Any reputable manager beats reuse. A few solid options:

• Bitwarden — open source, independently audited, free tier syncs across devices.
• 1Password — polished, audited, paid; adds a secret key on top of your master password.
• KeePassXC — open source and fully offline; you control the encrypted file and how it syncs.

The wider field, limited to managers still available:

Then:

1. Set a master passphrase of 6+ random words. It is the one password you memorise and never reuse anywhere.
2. Turn on two-factor authentication for the manager itself.
3. Write the master passphrase and recovery codes on paper and store them somewhere physically safe. Not in a notes app. Not in a screenshot.
4. Import or re-create accounts, starting with the most important: email, bank, phone carrier, cloud storage.

Use the manager's browser extension to autofill. It only fills on the exact domain the password was saved for, which makes it a quiet phishing filter: if it won't autofill, look hard at the URL.

4. Rotate when it matters, not on a calendar

Forced 90-day changes train people into Summer2026! → Autumn2026!. Current NIST guidance says not to require periodic changes, and to change a password when there's evidence it's compromised.

Change a password immediately when:

• the service announces a breach, or you get a breach alert;
• you typed it into a page you're not sure was real;
• you shared it, or entered it on a device you don't control;
• it's one of your old reused passwords — retire every one of them.

Most managers have a built-in breach / weak / reused password report. Run it, then work through the list.

5. Check for breaches without leaking the password

Have I Been Pwned tells you which breaches your email appeared in. Its Pwned Passwords API checks a password using k-anonymity: you send only the first 5 characters of its SHA-1 hash, and compare the results locally. The password itself never leaves your machine.

# read the password without echoing it or saving it to shell history
read -rs PW
HASH=$(printf '%s' "$PW" | shasum -a 1 | awk '{print toupper($1)}'); unset PW

# only the 5-char prefix is sent
curl -s "https://api.pwnedpasswords.com/range/${HASH:0:5}" | grep -i "${HASH:5}"
# a match prints SUFFIX:COUNT (times seen in breaches). no output = not found

Any match: that password is burned. Replace it everywhere it's used.

6. Add a second factor

A password alone is one lock. A second factor means a stolen password isn't enough. From strongest to weakest:

1. Passkeys / hardware security keys (FIDO2, e.g. YubiKey) — bound to the real site's domain, so they can't be phished. Use them wherever offered.
2. Authenticator app (TOTP codes) — strong, works offline. Back up the codes or seeds.
3. SMS codes — better than nothing, but vulnerable to SIM-swap attacks. Replace them when a better option exists.

Save every account's recovery codes in your password manager or on paper. Losing your second factor without them can lock you out permanently.

7. Security questions are passwords too

Your mother's maiden name and first school are public, or one social media post away. Treat security questions as extra passwords: answer with random strings and store the answers in your manager.

Q: What city were you born in?
A: correct-violet-anchor-ledger   ← generated, saved in the vault

8. Lock down the master keys

Your email account can reset almost every other password you own, and your phone number often can too. Give them the strongest protection you have:

• unique long password + passkey or hardware key on your email;
• a carrier account PIN / port-out lock on your phone number;
• remove SMS as a recovery option where the service allows it.

Checklist

Unique, long, managed. Do it once, and the next breach headline is someone else's problem.