Passwords are everyone's least favorite security tool. Here's how to make them useful without making your life miserable.

1. The single most important rule

One unique password per site. Reusing the same password across sites is how one breach compromises many accounts.

This is impossible to do in your head — that's what a password manager is for.

2. Use a password manager

Recommended:

  • 1Password — polished, $3-5/mo
  • Bitwarden — open source, free tier covers most needs, $10/year for premium
  • Dashlane — feature-rich
  • Keeper — corporate friendly

Each works across Windows, Mac, iOS, Android, browser extensions.

Your work may already provide one — check before paying.

3. The master password

The one password you remember. Make it:

  • Long (16+ characters)
  • Memorable (a passphrase: "correct horse battery staple")
  • Not used anywhere else
  • Not on your laptop's saved passwords

This is the only password you'll ever need to remember.

4. Don't change passwords routinely

Old advice (change every 90 days) has been retired by NIST. It led to:

  • "Password1!" then "Password2!" then "Password3!" — predictable
  • People writing them down

Modern guidance: change only if you suspect compromise.

5. Use MFA wherever possible

Even with weak passwords, MFA mostly protects you. See [MFA not working](/kb/mfa-not-working).

The order of MFA strength:

  1. Hardware key (YubiKey) — strongest
  2. Authenticator app push — very strong
  3. Authenticator app 6-digit code — strong
  4. SMS — weak (SIM swap risk)
  5. Email — weak (email is often what attackers want)

Use the strongest your system supports.

6. Login as little as possible

Browser-saved passwords, password manager autofill — use them. Less typing = fewer chances for keyloggers or shoulder-surfers.

7. Don't share passwords

Even with colleagues:

  • Use a shared account if multiple people need access
  • Or grant individual access (e.g. shared mailbox vs. sharing the password)
  • Or use the password manager's sharing feature (audit trail)

8. Notice unusual sign-in attempts

Microsoft and Google notify you of "unusual sign-in":

  • New location
  • New device
  • New IP address

If you didn't sign in, your password is compromised. Change immediately.

9. Check breach databases

Visit haveibeenpwned.com to check your email:

  • Lists any known breach you appeared in
  • If you used the same password on those sites, change it everywhere

Most modern password managers have built-in breach checking.

10. After a breach

If you find out you're in a breach:

  • Change the password on the breached site
  • If you reused that password elsewhere, change there too
  • Enable MFA if you hadn't
  • Monitor for unusual activity

When to ticket

Raise a ticket if:

  • Your work account password keeps being reset by someone
  • You see successful sign-in events from places you weren't
  • You need a password manager provisioned
  • A specific service needs MFA enabled that doesn't currently support it

Include relevant details — IT may need to investigate suspected compromise.