Strong passwords without the headache

Most people were taught that a good password is short and complicated, full of symbols and changed every few months. Current advice from security agencies is different: length matters far more than complexity, and the biggest risk by far is using the same password in more than one place.

Why reuse is the real danger

Websites get breached all the time, and the stolen email addresses and passwords are traded and tried automatically against other services. If the password for a shopping site you used years ago is the same as your work password, an attacker does not need to guess anything. They simply try it. That is why every important account needs its own password.

Use a passphrase

A passphrase is several unrelated words strung together, such as copper lantern river biscuit. It is long, which makes it very hard to crack, and much easier to remember and type than a jumble of symbols. Avoid song lyrics, quotes and anything about you that is easy to look up, such as your pet's name or your street. For your main work account, aim for at least four random words.

Let a password manager do the remembering

Nobody can remember a different strong password for every site. A password manager can. It stores your passwords in an encrypted vault, fills them in for you and creates new random ones when you sign up for something. You only need to remember one strong passphrase to open it. We can recommend and set up a business password manager for your team, so shared logins are stored safely rather than in a spreadsheet or on sticky notes, and access can be removed in one step when someone leaves.

Browsers and sticky notes

Saving passwords in your web browser is better than reusing one password everywhere, but it offers less protection and is harder to manage for a team. Passwords written on a note under the keyboard or in an unprotected document are the first thing someone looks for. If you have a list like that, tell us and we will help you move it somewhere safe.

When to change a password

You do not need to change a strong, unique password on a schedule. Change it straight away if you typed it into a page you are not sure about, if a service tells you it was breached, or if someone else may have seen it. And always pair your work password with multi-factor authentication; see Turning on multi-factor authentication.