Most of us have a password we have used since school, a version of it with a number stuck on the end, and a quiet suspicion that this is not ideal. That suspicion is worth listening to. Your email inbox is the master key to nearly everything else you own online: bank statements, shopping accounts, cloud photo backups, work tools. One guessable password in the wrong hands can unravel a great deal in an afternoon. The fixes are simple, free, and take less time than you would expect.

What makes a password strong

Length does most of the work. A short password, however strange it looks, can be broken by a computer working through combinations far faster than you could ever type them. A long one cannot. Sixteen characters or more is a sensible target, and a string of unrelated words is far easier to remember than a jumble of symbols.

purple-kettle-mango-tram is stronger than P@ssw0rd1, and you will actually recall it next month. The familiar trick of swapping letters for numbers and adding an exclamation mark produces something that looks complicated but follows patterns that cracking tools expect.

Three habits matter more than cleverness:

• Length. Aim for sixteen characters, or four or five random words.
• Uniqueness. A different password for every account. One leak should never open two doors.
• No personal clues. Names, birthdays, pet names and postcodes are the first things anyone tries.

Reusing passwords is the real danger

Imagine your details appear in a breach at a forum you joined in 2014 and forgot about. Attackers take leaked email-and-password pairs and try them automatically against Gmail, PayPal, Amazon and hundreds of other sites. This is known as credential stuffing, and it works precisely because so many people reuse the same combination. The forum itself does not matter. The password does.

Password managers: the practical shortcut

A password manager stores your logins in an encrypted vault and fills them in for you. You remember one strong master password; it remembers the other two hundred. Most can also generate random passwords, flag reused ones, and sync between your phone and laptop.

Getting started

1. Pick a manager — a dedicated app, or the one already built into your browser or phone.
2. Create a long, memorable master password. Write it down and keep it somewhere physically safe while you learn it.
3. Install the browser extension or mobile app so it can fill in forms.
4. Work through your accounts, starting with email, banking and anything holding payment details.
5. Delete the passwords saved in your browser once they are safely in the vault.

Turn on two-factor authentication for the manager account itself, and set up a recovery method in case you forget the master password. If you would rather not trust a cloud service at all, desktop tools that keep the vault on your own device exist, though syncing then becomes your problem.

Two-factor authentication, without the jargon

Two-factor authentication, usually shortened to 2FA, asks for a second piece of evidence when you sign in: not just something you know, but something you have. Even if someone steals your password, they still cannot get in without your phone or your security key.

The main types

• Text message codes. Better than nothing and widely available, but vulnerable to SIM-swap attacks and useless when you have no signal.
• Authenticator apps. Google Authenticator, Microsoft Authenticator, Authy and similar generate a fresh six-digit code every thirty seconds. A solid default.
• Hardware keys. A small USB or NFC device you tap to confirm. The strongest option, and excellent for email and banking.
• Passkeys. Increasingly common, and they replace the password entirely with a cryptographic key tied to your device.

Use whatever an account supports, then upgrade when you can. An authenticator app is a real improvement on a text message; a hardware key is better again.

Where to switch it on first

Not every account deserves the same attention. Prioritise in this order:

1. Your main email address — it can reset almost everything else.
2. Banking and payment services.
3. Cloud storage and photo backups.
4. Social media and messaging accounts.
5. Work tools, especially anything holding client data.

Many services let you trust a device for thirty days so you are not typing codes constantly. That is a reasonable trade-off on your own laptop; skip it on shared computers.

Backup codes, and not locking yourself out

When you switch on 2FA, most services show a list of one-time recovery codes. Save them. Print them, or write them in a notebook you keep at home — not in the same place as your master password, and not in a photo on the phone you might lose.

If your phone is stolen or replaced, that list is the difference between a ten-minute fix and a fortnight of pleading with support. It is also worth adding a backup email address or phone number to your most important accounts, and telling one trusted person where your recovery information lives in case of an emergency.

Your first hour of better security

Start with email, and do it today rather than someday. Change the password to a long passphrase you have never used elsewhere, save it in a manager, and switch on two-factor authentication. Then repeat the process for your bank and your cloud storage.

An hour of tidying now saves an unpleasant week later. Nothing here is complicated; it is a handful of small decisions, made once, that quietly protect everything else you do online. If you are unsure how your own bank or provider handles account recovery, ask them directly — general guidance like this cannot cover every provider's process.

Photo: rupixen / Pixabay