Effective Password Management: Tips for Creating and Managing Strong Passwords

Every day, millions of people log into email accounts, banking portals, social media profiles, and school platforms – and for most of them, a password is the only thing standing between their personal data and a potential attacker. Yet, according to a 2024 Global Password Management Survey by Bitwarden, 84% of users still admit to reusing passwords across multiple accounts. The risks are real: the Identity Theft Resource Center reported over 3,000 data breaches in 2024 alone, potentially exposing hundreds of millions of accounts. Understanding how to create strong passwords, use a password manager, and enable two-factor authentication is no longer optional – it’s an essential digital literacy skill.

Creating strong passwords 🔗

A strong password is your first and most fundamental line of defence online. The problem is that most people dramatically underestimate what “strong” actually means. Passwords like “Password1” or “123456” can be cracked by automated tools in seconds. So what makes a password genuinely strong?

Length matters more than complexity 🔗

NIST (the U.S. National Institute of Standards and Technology) is clear on this: the most important quality of a good password is its length. The Cybersecurity and Infrastructure Security Agency (CISA) recommends a minimum of 16 characters, with a mix of uppercase and lowercase letters, numbers, and symbols. The longer the password, the exponentially harder it becomes to crack.

One effective approach is to use a passphrase – a sequence of random words strung together. Canada’s Centre for Cyber Security recommends passphrases of at least 14 characters, noting that they are both longer and easier to remember than a string of random characters. A passphrase like “BlueMountainRiverSky7!” is far harder to crack than “B1u3M@n!” – and much easier to remember.

Avoid predictable patterns and personal information 🔗

Even a long password can be weak if it follows predictable patterns. Security guidelines consistently warn against using dictionary words, common expressions, song lyrics, or personal details such as birthdays, pet names, or hometowns – information that can often be found on social media profiles. Hackers use dictionary attacks, which systematically test common words and phrases, and credential stuffing, which uses username-password combinations leaked from previous breaches to try to access other accounts.

Use a unique password for every account 🔗

Reusing the same password across multiple platforms is one of the most dangerous habits in digital security. The 2024 Bitwarden survey found that 26% of respondents reuse passwords across 6 to 10 different sites. If a single platform suffers a data breach and your password is exposed, every other account using that password becomes immediately vulnerable. The rule is simple: one account, one unique password.

Password managers 🔗

Here’s the practical challenge: if every account needs a long, complex, unique password, how can anyone possibly remember them all? A NordPass study found the average person has around 100 passwords. No one can memorise 100 unique, complex passwords – and that’s exactly where password managers come in.

What a password manager does 🔗

A password manager is an application that generates, stores, and automatically fills in your passwords across websites and apps. CISA describes it as an easy-to-use program that not only stores passwords securely, but also alerts you when you have weak or reused passwords and can generate strong new ones for you. When you use a password manager, you only need to remember a single strong master password – the one that unlocks the manager itself.

NIST experts highly recommend password managers for exactly this reason: they solve the human problem of memory by making highly unique, long passwords accessible from almost any device. Popular options include Bitwarden (open-source and free), 1Password, and LastPass, among others.

Key benefits of using a password manager 🔗

Beyond storage, password managers offer several practical security advantages. They automatically detect and flag weak or duplicated passwords across your saved accounts. They generate truly random, high-strength passwords that no human would ever think to create. They fill login forms automatically, which also helps protect against phishing attacks – if a site’s URL doesn’t match the saved entry, the manager won’t autofill, alerting you to a potential fake page. Because password managers support multi-factor authentication (MFA) for their own login, the master password is also protected by an added security layer.

Choosing and securing your password manager 🔗

Canada’s Centre for Cyber Security advises choosing a password manager from a secure, reputable source and keeping it regularly updated. It also recommends protecting the manager itself with a strong master password and enabling multi-factor authentication. Treat your master password as your most important credential – it’s the key to all your other keys.

Two-factor authentication (2FA) 🔗

Even the strongest password can be stolen – through phishing, data breaches, or malware. That’s why two-factor authentication (2FA) exists: to ensure that a stolen password alone is never enough to access your account.

How 2FA works 🔗

According to Microsoft Security, 2FA is a method that requires users to verify their identity using two distinct factors before gaining access. These factors come from three categories: something you know (a password or PIN), something you have (a smartphone, hardware token, or authenticator app), and something you are (a fingerprint or facial scan). A typical 2FA login works like this: you enter your username and password as usual, then you are prompted to confirm a one-time code sent to your phone or generated by an authenticator app. Only when both steps are verified does the system grant access.

Types of 2FA methods 🔗

Not all 2FA methods offer the same level of protection. The most common options, roughly ordered from convenient to most secure, are:

SMS codes: A one-time code is sent via text message. It’s the most widely understood method, but it carries some risk – attackers can use SIM swapping to intercept SMS messages.

Authenticator apps: Apps like Google Authenticator or Microsoft Authenticator generate time-sensitive six-digit codes directly on your device every 30 seconds. Because codes are generated offline, they are not vulnerable to SIM swapping or interception.

Hardware security keys: Physical USB keys (like a YubiKey) that must be physically present to complete login. These are considered the strongest form of 2FA because they are cryptographically bound to the legitimate website’s domain, making them highly resistant to phishing and remote attacks.

Biometrics: Fingerprint scans or facial recognition, often used on smartphones, can serve as a second factor when paired with an authenticator.

Why 2FA makes a critical difference 🔗

The impact of enabling 2FA is well-documented. CISA states that using 2FA reduces the risk of account compromise by as much as 99%. A large-scale study in the Azure Active Directory environment showed that over 99.99% of accounts with 2FA enabled remained secure. Microsoft reports that 2FA blocks up to 99.9% of automated cyberattacks.

2FA also provides an early warning system. When someone attempts to log into your account, you receive a verification prompt on your device – even if you didn’t initiate the login. This instant alert allows you to deny the request and act quickly to change your password before any damage is done.

Chapman University’s Information Systems and Technology team recommends enabling 2FA on any account containing sensitive data – especially email, banking, and social media. Most platforms allow you to set it up in your account’s Security or Privacy settings, usually within just a few minutes.

Putting it all together 🔗

Strong password habits form a layered defence. A long, unique password for each account addresses the risk at the point of creation. A password manager removes the human bottleneck of memory, making it practical to maintain strong, unique credentials across dozens of accounts. And two-factor authentication ensures that even in a worst-case scenario – where your password is leaked or stolen – an attacker still cannot access your account without a second factor that only you possess.

NIST’s guidance is clear: don’t rely on a password alone. Use a password manager, make passwords long and unique, and enable multifactor authentication wherever possible. These three steps together represent the most practical and proven approach to online account security available to anyone today – no technical expertise required.

What do you think? With so many accounts to manage, do you think most people genuinely understand the risks of password reuse – or is convenience always going to win out over security? And given how effective two-factor authentication has proven to be, what do you think is stopping more people and institutions from making it the default requirement for every account?

References

1. https://www.hipaajournal.com/world-password-day/
2. https://www.nist.gov/cybersecurity/how-do-i-create-good-password
3. https://www.cisa.gov/secure-our-world/use-strong-passwords
4. https://www.cyber.gc.ca/en/guidance/best-practices-passphrases-and-passwords-itsap30032
5. https://www.microsoft.com/en-us/security/business/security-101/what-is-two-factor-authentication-2fa
6. https://www.loginradius.com/blog/identity/benefits-of-mfa
7. https://www.eset.com/blog/en/what-is/what-is-2fa-how-it-works/
8. https://rublon.com/blog/2fa-two-factor-authentication/
9. https://us.norton.com/blog/privacy/what-is-2fa
10. https://blogs.chapman.edu/information-systems/2024/10/04/the-importance-of-using-two-factor-authentication-2fa/