Passwords you don’t have to remember

When a website is breached, attackers take the leaked email and password pairs and try them automatically on email, banking, shopping and social media sites. It’s called credential stuffing, and it works because most people reuse passwords.

The fix isn’t a cleverer password. It’s a different password for every account, and the only practical way to manage that is to let software remember them.

Use a password manager

A password manager creates a long random password for each site, saves it, and fills it in for you. You remember one strong password, the one that unlocks the manager.

• Your phone and browser already have one built in: Apple Passwords, Google Password Manager, or Microsoft Edge’s. Using it is a big step up from reusing passwords.
• A dedicated manager such as Bitwarden or 1Password works across every device and browser you use, and makes it easy to share passwords with family.

Make the one password you remember count

Use a passphrase: four or more random, unrelated words, such as kettle-orbit-velvet-ninety. Length beats complexity. Don’t use song lyrics, quotes, or anything about you.

Start with the accounts that matter

Don’t try to change everything tonight. In order:

1. Your main email. Whoever controls it can reset the password on everything else.
2. Banking and myGov.
3. Any account that holds a saved card.
4. Everything else, the next time you sign in to it.