How to create strong passwords and use two-step verification
A password protects your email, bank and shopping accounts. Weak or reused passwords are the most common way accounts are broken into. A few habits make you much safer without needing to remember dozens of complicated codes.
Can log in to at least one online account, such as email.
Learn it
How it works
Length beats complexity. ‘Three random words’ (for example purple-kettle-river) is long, easy to remember and hard to guess.
Avoid personal details that others can find: pet names, birthdays, football teams, children’s names.
Use a different password for every important account, especially email. If one site is breached, the others stay safe.
A password manager (built into most browsers and phones) stores and fills unique passwords so you only remember one.
Turn on two-step verification (2SV, also called two-factor authentication or 2FA). Even if someone learns your password, they also need a code from your phone.
Never type your password into a page reached from an unexpected email or text. Go to the site yourself instead.
Worked example 1
Improve the password ‘Buster2019’ (a dog’s name and a year).
It uses a guessable personal detail and a year, so it is weak.
Pick three unrelated words: lantern, cactus, violin.
Join them, optionally with a number or symbol: lantern-cactus-violin7.
Save it in a password manager and turn on two-step verification.
Answer: lantern-cactus-violin7 (stored in a password manager, with 2SV on)
Try it online · print it · check it
Practice questions
Beginner · ages 16+
Strong passwords and two-step verification
NameDate
Write a short answer, such as yes, no or a few words.
1.Which is stronger: ‘Summer2024’ or ‘purple-kettle-river-moon’?
2.Should you reuse the same password on different sites? (yes/no)
3.What does 2FA stand for?
4.A text asks you to ‘confirm your password’ via a link. Safe to click? (yes/no)
5.What tool safely stores many unique passwords?
6.Is your pet’s name a good password? (yes/no)
7.How many random words does the ‘random words’ method suggest at least?
8.Which account is most important to protect, because it can reset others?
Beginner · answersAnswer key
Strong passwords and two-step verification — answer key
Write a short answer, such as yes, no or a few words.
1.Which is stronger: ‘Summer2024’ or ‘purple-kettle-river-moon’?purple-kettle-river-moon
2.Should you reuse the same password on different sites? (yes/no)no
3.What does 2FA stand for?two-factor authentication
4.A text asks you to ‘confirm your password’ via a link. Safe to click? (yes/no)no
5.What tool safely stores many unique passwords?password manager
6.Is your pet’s name a good password? (yes/no)no
7.How many random words does the ‘random words’ method suggest at least?3
8.Which account is most important to protect, because it can reset others?email
Tips
Common mistakes
Adding ‘1’ or ‘!’ to an old password and thinking it is new.
Writing passwords on a sticky note by the computer.
Approving a two-step login request you did not start.
