Why Complexity Alone Isn't Enough

Most of us have been told to make passwords longer, add symbols, and avoid obvious words. That advice isn't wrong — but it addresses only one part of a larger problem. A highly complex password that's used on ten different websites is still a serious vulnerability.

Here's why: when a website is breached and its user database is exposed, attackers don't just try that password on that site. They run it against hundreds of other services automatically — a technique known as credential stuffing. If your email and password combination from a breached forum is the same one protecting your bank account, complexity offers no protection at all.

The real goal isn't just a strong password. It's a unique strong password for every account you hold. That's a much harder problem — and it's why password managers exist. See why strong passwords keep failing people for a deeper look at the assumptions that leave accounts exposed.

80%+

Data breaches involving stolen or weak credentials

According to Verizon's Data Breach Investigations Report, the vast majority of hacking-related breaches involve compromised credentials rather than technical exploits.

Billions

Credential pairs available to attackers online

Security researchers have documented collections of billions of email-and-password combinations circulating on the internet, fueling large-scale credential stuffing campaigns.

Best Practices for Passwords That Actually Protect You

The following practices address the full scope of password security — not just how to construct one, but how to manage dozens of them without compromising your own system.

1

Use a unique password for every account, without exception.

Reusing passwords is the single most exploited vulnerability in consumer security. A breach at any one service immediately puts every account sharing that password at risk. Uniqueness breaks the chain that credential stuffing attacks depend on.

Example: If your streaming service is breached and you've used the same password for your email, attackers can access your inbox — and from there, reset nearly any other account you own.
2

Use a password manager to generate and store credentials.

Human memory can't reliably handle dozens of strong, unique passwords — and writing them down or reusing patterns defeats the purpose. A password manager generates truly random credentials and stores them encrypted behind a single master password. Password managers explain how they store data and what limitations to be aware of.

Example: A password manager can generate something like 'xQ7#mLp9!vTz' for your bank and a completely different string for your email — and you only need to remember one master password to access both.
3

Create passphrases for accounts that require you to memorize a password.

Your password manager's master password needs to be something you can remember without writing it down. A passphrase — a string of four or more random, unrelated words — is both memorable and highly resistant to guessing attacks.

Example: A phrase like 'correct-horse-battery-staple' is far harder to crack than 'P@ssw0rd123' and far easier to remember than a string of random characters.
4

Enable two-factor authentication on every account that supports it.

Two-factor authentication (2FA) adds a verification step — usually a time-sensitive code — that attackers can't obtain even if they have your password. It's particularly important for email, financial, and primary social accounts, which can serve as recovery routes for everything else.

Example: With 2FA active on your email account, a thief who obtains your password would still be blocked at login without access to your phone or authenticator app.
5

Audit your accounts periodically and remove ones you no longer use.

Old, forgotten accounts are a liability. If a service you signed up for years ago is breached, that old credential may still match something current — especially if you hadn't yet adopted strong password habits. Fewer active accounts mean a smaller attack surface.

Example: Search your inbox for registration confirmation emails to surface forgotten accounts, then delete or close any you no longer need.

Adding the Layer Passwords Can't Provide

Even a unique, complex password can be stolen through phishing, malware, or a data breach you had no control over. That's where two-factor authentication (2FA) comes in. When enabled, logging in requires something you know (your password) and something you have — typically a code from your phone.

This means that even if an attacker has your correct password, they still can't get in without that second factor. It's one of the most effective protections available to everyday users. Two-factor authentication adds a second layer of protection that passwords alone simply can't replicate.

Not all 2FA methods are equal, though. SMS text codes are better than nothing, but they carry risks that app-based authenticators don't. Learn more in our explainer on the difference between SMS codes and authenticator apps.

high Download a reputable password manager today and import or update the credentials for your three most important accounts — email, banking, and your primary social account.
high Turn on two-factor authentication for your email account right now — it's typically found under Security or Account Settings and takes less than five minutes.
medium Check whether any of your passwords have appeared in known data breaches by using a service like Have I Been Pwned (haveibeenpwned.com), then update any flagged credentials immediately.

Putting It All Together

Strong passwords, unique credentials per site, a password manager, and two-factor authentication aren't four separate chores — they're one interconnected system. Each element compensates for the others' limitations.

If you're also concerned about the broader habits that quietly erode your security over time, our piece on habits that undermine online security is a natural next read. And when you're ready to extend these protections beyond your accounts to your home network, keeping your home network secure covers the foundational steps every household should take.

Password Security Is Part of a Larger Picture

Passwords and 2FA are two components of a broader digital security posture. For a comprehensive overview covering devices, networks, accounts, and habits together, see The Full Picture: Protecting Your Digital Life Across Every Device and Account. No single measure is a complete solution — layered protection is the standard that security professionals recommend.

Share

Technology & Connection Editorial Team · Contributor

Technology & Connection Editorial Team is the collective byline for our editorial team and contributor network. Articles published under this byline or an editorial pen name are researched, written, and reviewed according to our editorial standards for clarity, consistency, and independence before publication.

The content on this site is for informational purposes only and is not a substitute for professional advice. Always consult a qualified professional for guidance specific to your situation.