Note (October 2026): This guide has been updated to reflect current NIST password guidance, which favors long passwords over forced complexity rules and ranks email codes and security questions below phishing-resistant methods such as passkeys.
To keep your logins and passwords secure, use a password manager to create a long, unique password for every account (NIST recommends at least 15 characters for a password used alone), sign in only on trusted networks or behind a VPN, turn on multi-factor authentication, and use passkeys or a hardware security key for your most important accounts.
Key Takeaways
- Length and uniqueness beat complexity: NIST’s SP 800-63B-4 sets a 15-character minimum for single-factor passwords and tells services not to force composition rules.
- A password manager removes the need to remember dozens of passwords.
- Public WiFi can be risky; a VPN encrypts traffic on networks you do not control.
- Any MFA is better than none, but CISA says only FIDO/WebAuthn methods, such as passkeys and security keys, are widely available phishing-resistant options.
- Change a password when there is evidence of compromise, not on a fixed schedule.
The days of basic online security are long gone. As our reliance on the internet has increased, so too has the level of threat and the associated criminal activity.
Brute force attacks, largely unsecured accounts, and weak passwords all contribute to poor digital security, and it could mean your personal and financial information is easy for threat actors to uncover.
Security Guide To Safer Logins And Passwords
Keeping your login details and passwords secure is a matter of choosing long, unique passwords (or passkeys), turning on stronger authentication methods, and taking care on networks you do not control. To help get your basic security protocols in order, we’ve compiled a concise guide to login and password safety.
Step 1: Use a password manager
Most people now have dozens of online accounts, and many of them are linked to payment cards, bank details or other financial information. CSO reported that in 2020, some of the most common passwords included “qwerty” “password” and “12345” – all of these are easy to guess and simple to hack. Little has changed since: NordPass’s 2025 list of the most common passwords, compiled from breached data, put “123456” and “admin” in the top two places, with “password” sixth. If you’re using a similarly weak password, it’s time to make some changes.
These passwords just don’t cut the mustard anymore, even if they’re easy to remember. In addition, you shouldn’t repeat passwords across accounts.
Remembering 30 or more long and complex passwords is a feat best reserved for those with a photographic memory. For most people, a password manager is the practical answer: it remembers every login so you do not have to.
With these programs, you log into your manager with a single long password or passphrase, then the program will automatically log you into your accounts when you’re online, making it easy to get stuff done and keep your details secure.
Most password managers have an in-built password generator, so you don’t even need to come up with complicated passwords.
If you’re reluctant to use a password manager, remember the following password rules.
- Make them long. The US National Institute of Standards and Technology (NIST) guidance SP 800-63B-4 sets a minimum of 15 characters for a password used on its own; a passphrase of several random words is an easy way to get there.
- Do not include personal information.
- A mix of numerals, upper and lower case letters and special characters can help, but length and uniqueness matter more: NIST’s current guidance tells services not to impose such composition rules and to check new passwords against lists of common and compromised passwords instead.
Step 2: Log in to accounts from secure and trusted networks only
In an ideal world, every WiFi network you encounter is safe and secure. Still, the reality is that many networks are a cybersecurity disaster zone and are riddled with digital threats. For instance, a study by security experts Coronet, reported in July 2018, ranked the public WiFi at 45 of the busiest US airports by risk to travelers and their devices; San Diego International scored worst, 10 out of 10, partly because a fake hotspot named “#SANfreewifi” was running an ARP poisoning attack.
From ARP (Address Resolution Protocol) poisoning to wireless phishing and many more in between, lax cybersecurity in airports means unsecured WiFi networks are providing attackers with a very useful vector.
As most people are not cybersecurity experts and cannot tell whether a network is to be trusted or not, privacy software is a must when connected to public WiFi networks. Using a VPN (Virtual Private Network) means adding a layer of security to your device and data.
VPNs create private browsing networks that encrypt the traffic between your device and the VPN server, hiding it from others on the same WiFi network. A VPN does not make your activity completely undiscoverable, so it works best alongside the other steps in this guide. If you must use open WiFi networks, whether in an airport or a city-center café, always turn your VPN on first.
Step 3: Always choose two-factor or multi-factor authentication
One of the easiest ways to create more secure accounts is to take advantage of two (2FA) or multi-factor (MFA) authentication. When you log into an account and use MFA, you will enter your password as normal, but then you need to supply a secondary authentication method that confirms that you are the account holder.
Many people choose to use 2FA authentication and receive a text message on their mobile. However convenient this might be, there is a growing awareness that text message authentication has some significant downfalls.
In 2016, Wired magazine reported that “SMS text messages are often the weakest link in two-step logins.”
Other second-step options include biometric verification (fingerprints and/or facial recognition), authenticator apps, an email, or a security question, but they are not equally strong. NIST’s SP 800-63B-4 restricts the use of phone-network (SMS) codes, prohibits email for out-of-band authentication, and treats only cryptographic methods such as FIDO2/WebAuthn as phishing-resistant.
Most platforms now offer 2FA and MFA as standard, but if you have accounts without this extra layer of protection, you should look into dedicated multi-factor authentication apps and software.
Many of these are free of charge, but choose your provider wisely and look into reviews before you sign up for free authentication services.
Step 4: Consider a security key for your most important accounts
A security key is an excellent way to add more protection to your most sensitive accounts. As with MFA, security keys provide an additional layer of protection against hackers, but unlike MFA measures, security keys are physical hardware.
These secondary devices, which often take the form of a USB stick, are used in conjunction with your main device. If the key is not in place, you can’t complete log-ins or access saved data.
Follow the four steps above to tighten your login and password security and keep your sensitive data safe.
What Are Passkeys and Should You Use Them?
A passkey is a sign-in credential based on FIDO standards that replaces the password. According to the FIDO Alliance, a passkey is stored on your phone, computer or hardware security key, and you sign in by unlocking that device with a fingerprint, face scan, PIN or pattern.
Passkeys are phishing-resistant because they use public-key cryptography and challenge-response sign-in, so there is no shared secret on the server for a fake site to steal. The FIDO Alliance describes two kinds:
- Synced passkeys are copied across your devices by a passkey provider’s cloud service, with end-to-end encryption, so a lost phone does not have to lock you out.
- Device-bound passkeys never leave one device; those held on a hardware security key give the highest assurance.
Adoption is growing. A 2024 survey commissioned by the FIDO Alliance found that 53% of people had enabled passkeys on at least one account. If an account offers a passkey, turning it on is one of the simplest upgrades you can make.
How Do Common Sign-In Methods Compare?
Not every second step offers the same protection. CISA, the US Cybersecurity and Infrastructure Security Agency, states that any MFA is better than none, but that “the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.”
| Method | Phishing-resistant? | Notes (NIST SP 800-63B-4 / CISA) |
|---|---|---|
| Password only | No | NIST minimum of 15 characters when used alone; should be checked against lists of compromised passwords |
| Security question | No | NIST says services must not prompt for knowledge-based questions when a password is chosen |
| Email code | No | NIST prohibits email for out-of-band authentication |
| SMS or voice code | No | Classed by NIST as restricted; still better than no MFA |
| Authenticator app code | No | Manually entered codes are not phishing-resistant under NIST |
| Passkey (FIDO2/WebAuthn) | Yes | Cryptographic sign-in tied to the real website |
| Hardware security key | Yes | Device-bound FIDO credential; the strongest option for important accounts |
What Should You Do If a Password Is Leaked?
NIST’s guidance says passwords should not be changed on a fixed schedule, but must be changed when there is evidence of compromise. If a service tells you about a breach, or you find your address in a breach database, act quickly:
- Change the password on the affected account to a new, unique one, ideally generated by your password manager.
- Change it anywhere else you reused the same password.
- Turn on a passkey or MFA for that account if you have not already.
- Check recent sign-in activity and connected devices, and sign out sessions you do not recognize.
- Watch for follow-up phishing emails that mention the breach.
Our guide on how to check if your passwords have been compromised explains the checking step in more detail.
Common Login Security Mistakes to Avoid
- Reusing one password. A single breach then unlocks every account that shares it.
- Relying on password hints. NIST says services must not store hints that anyone can read before signing in.
- Trusting a hotspot by its name. The 2018 Coronet study found a fake network posing as official airport WiFi; see how to know if Wi-Fi is secure.
- Typing codes into a page reached from an email link. One-time codes are not phishing-resistant, so learn the warning signs in our phishing protection guide.
- Leaving the master password weak. A password manager is only as safe as the passphrase and MFA that protect it; more tips are in ways to increase password management security.
Biometrics such as fingerprints are convenient for unlocking a device or passkey; for the trade-offs, read the pros and cons of biometric authentication.
Frequently Asked Questions
How long should a password be?
A password used on its own should be at least 15 characters long, according to NIST’s SP 800-63B-4 guidance. NIST also says services should allow passwords of at least 64 characters, so a long passphrase made of several random words is a good choice.
Do I need to change my passwords regularly?
No, not on a fixed schedule. NIST’s current guidance says services should not force periodic password changes, but a password must be changed when there is evidence it has been compromised, such as a data breach.
Is SMS two-factor authentication still worth using?
Yes, if it is the only option. CISA says any MFA is better than no MFA, but NIST classes SMS codes as a restricted authenticator. Where a service offers an authenticator app, passkey or security key, those are stronger choices.
Are passkeys safer than passwords?
Passkeys are safer against phishing. The FIDO Alliance explains that passkeys use public-key cryptography, so the website never holds a shared secret that a fake site could steal, and you unlock them with your device’s fingerprint, face scan or PIN.
What is the most common password?
“123456” topped NordPass’s 2025 list of the most common passwords, ahead of “admin” and “12345678”. Passwords like these appear on breached-password blocklists and are among the first that attackers try.
Justwebworld has published guides since 2012. How we write and update articles Report an error
