Staying safe online · Lesson 1 of 5

Passwords and two-step sign-in

Use a different long password for every important account, keep them in a password manager, and turn on two-step sign-in.

Free — no account needed to read

Many people use the same password, or small variations of it, across many accounts. When one website is breached, which happens regularly, criminals try that email and password on banks, email and social media. One leak can open everything.

The safest habit is a different, long password for every important account. Nobody can remember dozens of those, which is why password managers exist: they create and store strong passwords so you only need to remember one. Many phones and browsers include one built in.

Two-step sign-in adds a second check, such as a code from an app or a prompt on your phone, so that a stolen password alone is not enough. Turn it on first for your email, because email is how most other accounts are reset. Keep your backup codes somewhere safe.

See it happen

Carlos uses the same password for his email, bank and a small online forum. The forum is hacked, and a week later someone tries to log into his email from abroad.

The first reaction

The forum was a tiny site with nothing important on it, so it did not seem to matter what password he used there.

With the idea

He changes his email password straight away, turns on two-step sign-in, and uses a password manager to give every account its own password. The login attempt fails, and his other accounts are no longer linked by one secret.

What changed

He stopped reusing one password and added a second check to his most important account.

Easy to take the wrong way

Good security does not require you to be a technical expert or to worry constantly. A few settings, done once, remove most of the everyday risk.