Passwords and Second Factors: The Hour That Fixes Most of It

Almost every account takeover that makes the news comes down to the same fact: the password was reused, or it was predictable, or it was phished. None of those require any technical skill. The reason a small number of changes eliminates almost all of that risk is that attackers automate, and automation is defeated by uniqueness and by a second factor — not by a more elaborate password.

Why the password advice you have been given is half right

The old advice was: make it long, make it complex, never reuse it. All three are correct, and the third is effectively impossible to follow by hand across two hundred accounts. Meanwhile the emphasis on complexity actively hurts: P@ssw0rd1! is far weaker than correct-horse-battery-staple-42, because automated guessing attacks try the common substitutions first and a long phrase has an enormous number of combinations.

The real requirement is length and uniqueness. A four-word passphrase is both strong and, critically, something a human can actually recall and type. If you can only do one thing today, it is to stop reusing passwords — because reuse means one breach anywhere exposes every account you have, which is why a single site's data leak becomes a global problem for you.

What a password manager actually does

A password manager stores your credentials in an encrypted vault and fills them into pages for you. Three things follow from that, and they are the reason to bother:

You only have to remember one strong passphrase, which can be long and memorable because it is the only one you need.
You get a unique, generated password for every account, so a breach at one site tells an attacker nothing useful about any other.
You can see everything you have in one place, which makes it possible to find and fix the accounts you have not touched in years — and to spot the ones you do not recognise.

The main new risk is that your vault becomes a single point of failure, so the master passphrase has to be genuinely strong and genuinely memorised rather than written on a sticky note. Second-factor support and a solid export function are the features worth comparing between products; see the privacy guide for the questions to ask a provider about how they can and cannot read your data.

Second factors, ranked

Method	Phishable?	Usable	Verdict
Passkey or security key	No — bound to the site	Yes, once set up	Best available. Nothing to steal and nothing to type
Authenticator app code	No	Yes	Excellent, and the sensible default today
Push notification with number matching	Harder but possible with a relay attack	Yes, mostly	Good, but require a number match and be suspicious of unexpected ones
SMS text message	Yes, with SIM swap or interception	Yes	Better than nothing, worse than everything above
Security questions	Yes, and answers are often public	Yes	Not a second factor. Treat as a weak password
Nothing	n/a	n/a	The common case, and the reason credential stuffing works

The distinction that matters most is whether the factor is phishable. A one-time code is useless to an attacker sitting on a fake login page, because the code only exists on your device. An SMS code does not have that property, and that is the whole difference between the two.

Doing it in an order that works

Set up a password manager and write a strong master passphrase

Four or five unrelated words, memorised, never written down. This is the one secret you cannot outsource.
Add the accounts that matter first

Email, banking, your identity provider, cloud storage. These are the ones others can use to reset the rest.
Change your email password first

Email is the master key. Anyone who controls it can reset every other account you have.
Turn on two-factor for those accounts, storing codes in the manager

Then add a second method on the same account, because you will eventually lose your phone.
Work through the rest, changing the password on each account you open

Slower and far better than a purge-and-regenerate day that gets abandoned halfway.
Turn on the account's own alerts

Most services offer login notifications. They are free, and they are how you find out quickly.

Keeping it maintainable

Security that depends on ongoing effort collapses after a busy month. The setup above has almost no ongoing cost: the browser extension fills credentials, the authenticator generates codes, and nothing needs updating. Anything that requires you to remember a different thing per site will not survive, no matter how good the advice is.

Twice a year, spend ten minutes in your password manager looking at the vault — the unused accounts, the ones still on old passwords, anything you do not recognise. Removing what you no longer use and rotating the important ones is the entire maintenance routine. Related: cybersecurity basics covers what to do when something has actually gone wrong.

Common questions

Frequently asked questions

Is it safe to keep all my passwords in one place?

It is safer than the alternative, which is a dozen reused passwords, because a manager encrypts the vault locally and a breach of the provider exposes encrypted blobs rather than readable credentials. The realistic risk is a weak master passphrase or a compromised device, both of which are mitigable. That is a much better risk profile than reuse.

Should I use my browser's built-in password manager?

It is a genuinely good option if you use one browser family across your devices, since the passwords stay in your operating system's encrypted keychain. The limits are weaker sharing across platforms, and a browser reset is harder to recover from. A dedicated manager is the better answer if you use mixed devices, and the browser one is a perfectly sensible start.

What about passkeys?

They are the direction of travel and the right long-term answer. A passkey is bound to a specific site and cannot be phished, because there is nothing to relay. The current friction is ecosystem support and recovery: if you lose every enrolled device and your synced provider, recovery can be harder than with a password and a code. Adopt them where offered, and keep a second factor as well.

What should I do if a service says my data was breached?

Change the password there first, and if you reused it anywhere, change it everywhere — that reuse is why the breach matters. Then check whether the service exposed more than passwords, such as addresses or partial card numbers, and consider adding two-factor if you have not. Do not panic-search: changing a password on a site you reached from an email link is exactly the trap these breaches enable.

Where to go next

These are the services referenced above. Compare them on your own terms before you sign up for anything.