Strong passwords and password managers

Passwords are still the front door to your email, banking and business apps. The goal isn't a complicated password you can't remember. It's a long, unique password for every account, stored safely.

Use passphrases instead of passwords

Length matters more than odd symbols. A passphrase made of four or more random, unrelated words is both strong and easy to remember.

• Weak: Summer2025! (short, common pattern, easy to guess)
• Better: lantern-mango-bicycle-thunder (long, random words)

Aim for at least 14 to 16 characters. Avoid names, birthdays, addresses, pet names, your company name, or anything someone could find on social media. Don't use famous quotes or song lyrics, either.

Use a different password for every account

When a website gets hacked, criminals try the stolen email and password on other sites, such as Microsoft 365, banking and online stores. If you reuse passwords, one breach can unlock many accounts. Your work email password in particular should never be used anywhere else.

Let a password manager remember them

Nobody can remember dozens of unique passphrases. A password manager is an app that stores your passwords in an encrypted vault, fills them in for you and can create strong random passwords. You only need to remember one strong master passphrase.

• Choose a well-known, reputable password manager. Built-in options like Apple Passwords or the one in Microsoft Edge or Google Chrome are better than reusing passwords.
• For a business, a manager with shared vaults lets your team share access to accounts without sending passwords around.
• Protect the password manager itself with a strong master passphrase and multi-factor authentication.

Never share passwords by email or text

• Don't send passwords in emails, text messages, chats or sticky notes. These can be forwarded, stored for years or seen by others.
• If someone on your team needs access, use the sharing feature of your password manager or give them their own account.
• Don't write passwords on paper near your computer.

When to change a password

You don't need to change strong, unique passwords on a schedule. Change a password right away if:

• You typed it into a suspicious website or email form.
• A service tells you it had a data breach.
• You shared it with someone who no longer needs access, such as a former employee.
• You notice sign-ins or activity you don't recognize.

Add a second layer

Even the best password can be stolen. Turn on multi-factor authentication (MFA) wherever it's offered, starting with email, Microsoft 365, banking and your password manager. See our article on setting up MFA with Microsoft Authenticator.

Published on - 01-01-1970 05:30am