Most of us still set passwords out of an old habit: one capital letter, a few digits, an exclamation mark for good measure. That kind of password is hard for people to remember yet easy for computers to guess, and that’s the paradox of security today.
In this article, we’ll talk about how to create passwords that are both secure and livable, and get acquainted with passkeys, a new way of signing in that’s gradually replacing passwords at many major services.
Length matters more than complexity
The key to a good password isn’t how many odd characters it has, but how long it is. Computers crack passwords by trying millions of combinations per second, and each added character multiplies the number of combinations they must try. A string of four words strung together like tableau chair window march is much longer and harder to crack than Abc@123.
The easiest approach is to come up with a nonsensical but vivid phrase that’s meaningful only to you, for example stringing together four random, unrelated words. You remember it like a funny image, while a computer has to grind away for a very long time to find it.
Don’t reuse one password everywhere
The most common mistake isn’t a weak password, but using the same password for email, banking, social media and even trivial shopping sites. It only takes one of those sites getting its data leaked for a crook to try that very password on all your other accounts.
In reality, many account losses don’t come from being hacked directly, but from an old password leaking at some service and then being tried again elsewhere. So the simple principle is: a separate password for each important account.
A password manager carries the hard part
If every place has a different long password, of course no one can remember them all. That’s where a password manager comes in. You only need to remember a single master password to open the vault, and the software creates, stores and fills in the rest for you.
Many people hesitate, thinking putting all their eggs in one basket is dangerous. But a strongly encrypted vault with two-factor authentication is still far safer than reusing a few easy-to-guess passwords everywhere, or jotting them on a sticky note on the screen.
What a passkey is and why it’s worth noticing
A passkey is a way to sign in without typing a password. Instead of remembering a string of characters, your device holds a secret digital key, and you unlock it with your fingerprint, face or the device’s PIN. When you sign in, the service and the device shake hands with each other without sending any password anywhere.
The biggest strength of a passkey is that it’s nearly immune to phishing. Since there’s no password to type out, you can’t be tricked into entering it on a fake site. Crooks also have nothing to steal from the service’s servers, because the secret part always stays inside your device.
How to start using passkeys
Many major services such as email, social media and digital wallets already let you create a passkey right in the security settings. You go to the sign-in section, choose to add a passkey, then confirm with your fingerprint or face and you’re done. From then on, signing in is just a single tap.
You don’t have to drop passwords right away. The sensible approach is to enable passkeys on your most important accounts first, keep the password as a backup, then expand gradually once you’re used to it. Passkeys usually sync automatically between devices in the same ecosystem, so you can still use them when you switch phones.
Check whether your password has been leaked
Even a good password can be exposed if the service where you use it suffers a data breach. There are tools that let you check whether your email address appears in known data breaches, so you can promptly change your password at the places involved.
Many browsers and password managers now also warn you when they detect that a password you’re using has appeared in a breach. Don’t ignore these warnings; they’re a timely reminder to change your password before crooks can take advantage.
You don’t need to change everything in one day. Start by resetting your email password to something really long, install a password manager, then try enabling a passkey for your most important account. Those small steps add up to make your digital life markedly safer.