Cyber / BasicsFree practice · Passwords
Most advice about passwords is about how they look. What actually keeps an account closed is simpler and less fun: how long the password is, whether it is used anywhere else, and whether the e-mail account behind it is the strongest one you have.
A short password with symbols swapped in is still short, and short is what guessing software is good at. Four or five unrelated words you can picture — a lantern, a river, a Tuesday, a kettle — are easy for you and slow for anyone else, because there are far more four-word combinations than eight-character ones. If you want one rule: make it long, then stop worrying about clever.
Reusing a password is how one leak becomes several. Sites lose their password lists; it happens quietly and often. When a list appears, the first thing tried is the same e-mail and password on every other well-known service. A password used once can only open one door.
Your e-mail account is where every other account sends its "reset your password" link. Whoever controls it controls the rest. Give it the longest password you have, never reuse it anywhere, and turn on the second sign-in step there before anywhere else.
A password manager generates a long, unique password for every account and fills it in for you. You remember one. It also notices when a site you use appears in a leak. Recovery questions belong in it too: your first pet and your childhood street are answers other people can find, so treat them as passwords — invent them, store them, forget them.
Which is stronger?
A. Tr0ub4dor&3 B. coffee lantern tuesday river
B. A looks harder and is 11 characters with predictable swaps; B is 28 characters of ordinary words. Length is the whole difference, and B is the one you will still remember in a month.
| Question | If the answer is no |
|---|---|
| Is my e-mail password used nowhere else? | Change it today; it is the master key. |
| Does my e-mail account have a second sign-in step? | Turn it on before reading further. |
| Do I use a manager for everything else? | Install one; move accounts as you use them. |
| Are my recovery answers invented, not true? | Replace them and store the new ones in the manager. |
| Is anything still my old "one password for everything"? | Start with the accounts that hold money or messages. |
The pairs round ("which is stronger, and why"), the recovery-question round, the "one account opens the others" sequence, and spaced review that brings back whatever you missed. Four languages, offline once signed in, $6 for the first year until 1 December.
The same three-question demo subscribers start with — a password pair may be among them.