Password Security and MFA: A Practical Guide
Passwords are still the front door to most of your accounts, and weak or reused passwords are behind a huge share of breaches. Pairing a strong password with multi-factor authentication (MFA) is the most effective thing most people can do to stay safe online.
What makes a password strong
Length matters more than complexity. A long passphrase of random words is both harder to crack and easier to remember than a short string of symbols. Aim for at least 12 to 16 characters.
- Use a unique password for every account, never reuse.
- Prefer a passphrase: four or more random, unrelated words.
- Avoid names, birthdays, and anything guessable from your social media.
Use a password manager
No one can remember a strong, unique password for every account, and you should not try. A password manager generates and stores them for you, so you only remember one strong master password. It also warns you about reused or breached passwords.
What is MFA and why it matters
Multi-factor authentication adds a second step beyond your password, a code, an app approval, or a security key. Even if an attacker steals your password, they cannot log in without that second factor. MFA blocks the overwhelming majority of automated account-takeover attacks.
- App-based codes or push approvals are stronger than SMS codes.
- Hardware security keys (FIDO2/passkeys) are the most phishing-resistant option.
- Turn MFA on for email first, it is the key to resetting everything else.
How it plays out in the real world
Based on real, widely reported incident patterns; names and details are illustrative.
One reused password, four years later
In 2019, a small forum Sarah once joined was breached. The stolen email-and-password list circulated for years. In 2023, an automated tool tried those old combinations against major email providers, a technique called credential stuffing, and Sarah's inbox opened on the first try, because she had reused the same password.
The attackers did not announce themselves. They set up a hidden forwarding rule, watched her email for weeks, and used password resets on her shopping and banking accounts, all of which her inbox controlled.
- Your email password is the master key. Whoever controls your inbox controls password resets for everything else. That password must be unique, and the account must have MFA.
- Breaches age like landmines, not milk. A password leaked years ago still works today if you never changed it. A password manager makes unique passwords effortless, and haveibeenpwned.com shows what has already leaked.
- MFA turns a stolen password into a dead end. With MFA on, the 2019 leak would have been useless. One minute of setup beats months of account recovery.
Test yourself
Test your knowledge with a free, custom quiz.
Frequently asked questions
Are passphrases really better than complex passwords?
Yes. A four-word random passphrase has more entropy than a typical eight-character password with symbols, and it is far easier to remember. Length is the biggest factor in resisting cracking.
Is SMS-based MFA safe?
It is much better than no MFA, but SMS codes can be intercepted or SIM-swapped. Where possible, use an authenticator app, push approvals, or a hardware security key instead.
What is a passkey?
A passkey is a modern, phishing-resistant login that replaces the password entirely, using cryptographic keys stored on your device. Passkeys cannot be phished or reused, and are increasingly supported by major services.