How to Protect Your Online Accounts: Passwords & 2FA Explained

Most account break-ins don't involve sophisticated hacking — they happen because of weak, reused passwords. The good news: three simple habits protect you from the vast majority of attacks.

Habit 1: Use long, unique passwords

Length beats complexity. A passphrase like orange-battery-window-cricket is far stronger than P@ssw0rd1 and much easier to remember.

The rules that matter:

• At least 12–16 characters — every extra character multiplies the time needed to crack it.
• Unique per account — if one site leaks your password, attackers immediately try it on your email, bank and social accounts. Reuse is how one breach becomes ten.
• No personal info — names, birthdays and phone numbers are the first things attackers try.

Habit 2: Let a password manager remember them

Nobody can memorise 50 unique passwords — and you shouldn't try. A password manager generates and stores strong passwords for every site; you only remember one master password.

Reputable options include Bitwarden (free and open source), 1Password and the built-in managers in modern browsers. Any of these is dramatically safer than reusing passwords or keeping them in a notes app.

Habit 3: Turn on two-factor authentication (2FA)

2FA adds a second lock: even if someone steals your password, they still can't get in without the second factor.

From strongest to weakest:

1. Hardware security key — a physical USB/NFC key. Strongest option, used for high-value accounts.
2. Authenticator app — apps like Google Authenticator or Authy generate a fresh 6-digit code every 30 seconds. Strong and free; this is the best choice for most people.
3. SMS codes — better than nothing, but vulnerable to SIM-swap attacks. Use only when the account offers no other option.

Enable 2FA first on your email account — it's the master key to everything else, because password resets for other sites go through it.

Bonus: recognise phishing

Strong passwords don't help if you type them into a fake site. Warning signs of phishing:

• Urgent pressure ("your account will be closed in 24 hours").
• Sender address that doesn't match the real company domain.
• Links whose actual URL differs from the visible text — hover before you click.
• Requests for passwords or codes. Legitimate companies never ask for these.

When in doubt, don't click the link — open the website yourself by typing its address.

Quick checklist

• Email account: unique passphrase + authenticator-app 2FA
• Bank and payment accounts: unique passwords + 2FA
• Install a password manager and migrate your top 10 accounts
• Never reuse your email password anywhere else

Practice exercises

Security knowledge only counts when applied. Do these three today — the whole set takes under 30 minutes.

Exercise 1 (10 min): Audit your three most important accounts — email, bank, main social profile. For each, check whether the password appears in known breaches with our Password Leak Checker (it is safe — the password never leaves your browser). Replace anything that is found, using the Password Generator.

Exercise 2 (10 min): Enable authenticator-app 2FA on your primary email account right now — email first, because it can reset every other account. When the backup codes appear, save them offline before clicking continue.

Exercise 3 (10 min): Install a password manager and migrate just your top five accounts today. Do not attempt all your accounts at once — five today beats a hundred "someday".