Passwords: long, different for each account, kept in a manager or a book

Choose where passwords live, make a long new password for your main email, find the accounts that share a password, and change the money accounts next.

1. Why a reused password is the main danger Understand

Most advice about passwords is about making them hard to guess. The bigger risk for most people is simpler: the same password, or nearly the same one, on many accounts. This section explains why, and why the main email comes first.

How passwords get stolen

A data breach is when criminals copy information from a company's systems, often including the email addresses and passwords of the company's customers. The UK National Cyber Security Centre (NCSC) says the most common way passwords are stolen is a breach at an organization that holds them, and that this can happen even to people who looked after their passwords well (NCSC, Turn on 2-step verification, the UK government's cyber security agency). You did nothing wrong when a shop you used years ago is breached. What you can control is what that one stolen password opens.

Credential stuffing is the next step: criminals take the email addresses and passwords stolen in one breach and try them on other sites, such as email, banks and shops. NCSC says it works because many people use the same password for different accounts. A password that is long and hard to guess is still exposed by a breach. A password that is used on one account only exposes that one account.

This is why this manual asks for a different password on each account before it asks for anything clever. Changing one letter or adding a number at the end does not make a password different in the way that counts: a person, or a program, who sees Garden2019 in one breach will try Garden2020 next. The NIST Digital Identity Guidelines, SP 800-63B-4 (the US federal standard for how services handle sign-in, final July 2025) tell services to check new passwords against lists of passwords from earlier breaches and to discourage "trivial modifications" of rejected ones. Convention

Why the main email comes first

Your starting list marked the main email as one of the two keys to everything else. The reason is the "Forgot password?" link. Almost every account sends its reset link to an email address. NCSC says that someone who gets into your email can reset all your other account passwords, read private details including banking information, and send messages that look like they come from you (NCSC, Use a strong and separate password for your email). So the email password is the one to keep for that account alone. NCSC's advice: if you have reused your email password anywhere, change the email password as soon as possible.

The archived CISA page on passwords tells a short story that shows the chain: a reused password let someone into a person's email, and from there into the bank (CISA, Use Strong Passwords, the US Cybersecurity and Infrastructure Security Agency; the page carries CISA's "Archived Content" banner, so we cite it as an example only). CISA's current campaign still lists strong passwords and a password manager among its core steps for everyone (CISA, Cybersecurity Awareness Month).

What this chapter changes, and what it leaves alone

This chapter changes one password for certain: the main email's. It finds the others that are reused, and it starts on the money accounts. It does not ask you to change every password today. Two-step sign-in, which protects an account even when the password is stolen, is Two-step sign-in and passkeys. NCSC puts two-step sign-in first of all and different passwords second (NCSC, Managing your passwords). This manual does passwords first only because two-step sign-in is easier to set up once the password and the place it lives are settled. Do both. Our convention

2. What makes a password strong

A strong password is long and picked at random. Symbols and capital letters matter much less than most people were taught. This section gives the rule this manual uses, the arithmetic behind it, and when to change a password.

The rule this manual uses

Make each important password one of these:

• Four or more random words, such as words picked with dice from a word list, or
• 15 or more characters made by a password manager's generator.

That rule is built from what US and UK agencies tell people. The Federal Trade Commission (FTC) says to aim for at least 15 characters and suggests passphrases of random words (FTC, Protect Your Personal Information From Hackers and Scammers, the FTC's consumer advice page, dated November 2024). CISA's archived page suggests 4 to 7 unrelated words. NCSC says three random words are long enough and strong enough for most purposes (NCSC, Three random words). This manual sits at four words, inside that range. Who says what, and what each figure applies to, is under Go deeper below. Our convention

A passphrase is a password made of several words. The words have to be random: picked by chance, by dice or by a generator, not chosen by you. People are poor at making random choices. EFF's guide says so directly (EFF Surveillance Self-Defense, Creating Strong Passwords, from the Electronic Frontier Foundation, a digital rights nonprofit). A favorite saying, a song line, a name and a year, or four words that tell a story about you are not random. The FTC says to avoid common phrases, song lyrics and movie quotes. NCSC adds birthdays, favorite sports teams, and family and pet names, since many of those are on social media. Physical principle

Symbols, capitals and swapped letters

NIST's standard tells services not to demand "mixtures of different character types," such as a capital, a number and a symbol. It tells them to require length instead. NCSC says swapping letters for look-alike numbers (an o for a zero) does not make a password significantly stronger, because criminals know the trick, and it makes the password harder to remember.

The FTC still suggests mixing upper and lower case, numbers and symbols. Mixing types adds a little to a short password; length and randomness add much more. Many sites still demand a capital, a number or a symbol. When one does, add them to your passphrase where the site asks; it does no harm. Product-specific

The arithmetic, in plain words

The passphrase calculator counts how many possible passwords a method could produce. Here is what it does.

The Electronic Frontier Foundation (EFF) publishes a long word list of 7,776 words for picking words with dice (EFF, New Wordlists for Random Passphrases, 2016). If one word is picked at random from that list, it could be any of 7,776. A second random word could again be any of 7,776, so two words together could be any of 7,776 times 7,776 combinations. Every word you add multiplies the count by 7,776 again.

Those counts get huge fast, so they are usually written in bits. A bit is one doubling: each extra bit doubles the number of possibilities. The number 7,776 is about 2 multiplied by itself 12.9 times, so each random word from the long list adds about 12.9 bits. The calculator's formula is bits = number of words × log2(list size), where log2 counts the doublings.

One worked number: six random words from the long list give 6 × 12.9, or about 77.5 bits. That is about 2 to the 77th power possible passphrases. EFF's dice page gives the same figure for its six-word example (EFF, Dice-Generated Passphrases). EFF suggests six words for most uses; this manual's four-word floor is for an account password, where the site limits how fast anyone can guess. Physical principle

When to change a password

Change a password when it was in a breach, when you shared it, or when another account uses the same one. Do not change passwords on a calendar. NIST tells services not to make people change passwords on a schedule, and to force a change when there is evidence a password was stolen. Changing a good password every few months tends to produce small, predictable changes, which is the pattern credential stuffing exploits. Convention

3. Where passwords live: a manager or a book

Different passwords for every account are more than anyone can remember. NCSC says remembering them all is difficult, if not impossible. So each password needs a place to live. This manual offers two: a password manager, or a password book kept at home. Pick one now. You can move from a book to a manager later, or keep both, as the worked example in this chapter does.

A password manager

A password manager is a program that stores your passwords, fills them in when you sign in, and can make new random ones for you. Every phone and computer this manual covers has one built in: Apple Passwords on iPhone, iPad and Mac; Google Password Manager on Android phones and tablets, Chromebooks and in Chrome; and Microsoft Password Manager in the Edge browser on Windows. They cost nothing. This manual shows only these built-in ones. Product-specific

A manager does four useful things, according to NCSC:

• It makes a strong, different password for each account.
• It fills the password in for you. This is called autofill.
• It syncs your passwords to your other devices signed in to the same account.
• It warns you when a saved password has appeared in a breach.

Autofill matters for a reason beyond saving typing. Phishing is a message or a fake website that tries to get you to type your password or a code into it. NCSC says autofill helps protect you from phishing because the manager fills a password only on the correct website. If you tap a link in a text, land on a page that looks like your bank's, and the manager offers nothing, that silence is a warning. Check the address yourself before you type anything. Recognizing scams covers fake sites in depth. Product-specific

NCSC says it is safe to let your own device or browser save your passwords, and that it is the easiest way to keep them, especially if you use one maker's devices throughout. Two cautions come with it, both from NCSC. Do not save passwords in a browser on a shared computer outside your home, such as one at a library. And a saved password is only as safe as the device and the account it is saved in. So keep the phone's passcode (Your phone and tablet) and the device account's own password strong, and leave automatic updates on.

Turn on the built-in manager on each device

Use the steps for each device you have. If you saved your devices in setup, the box under "Your setup" shows only yours.

On an iPhone or iPad. Apple Passwords comes with iOS 18 and iPadOS 18 and later (Apple Support, Use the Passwords app).

1. Open the Settings app.
2. In Settings, tap General.
3. In General, tap AutoFill & Passwords.
4. Turn on AutoFill Passwords and Passkeys.
5. Go back to the first Settings screen and tap your name at the top.
6. Tap iCloud, then tap Passwords and Keychain.
7. Turn on iCloud Keychain, so your passwords reach your other Apple devices.

In short: Settings > General > AutoFill & Passwords > AutoFill Passwords and Passkeys, then Settings > [your name] > iCloud > Passwords and Keychain. Your saved passwords are in the Passwords app.

On a Mac.

1. Open the Apple menu at the top left of the screen.
2. Choose System Settings.
3. In System Settings, click General.
4. Click AutoFill & Passwords.
5. Turn on AutoFill Passwords and Passkeys.

In short: Apple menu > System Settings > General > AutoFill & Passwords. Apple says a Mac can fill passwords in other browsers through an extension from the browser's own store.

On an Android phone or tablet. Google Password Manager saves passwords to the Google Account the device signs in with, and fills them in sites and apps (Google Account Help, Get started with Google Password Manager). To see what it holds, from any device:

1. Open a browser.
2. Go to passwords.google.com.
3. Sign in with your Google Account if asked.

In short: passwords.google.com. Google says to add recovery info and turn on 2-Step Verification to protect saved passwords. Phone settings menus differ by maker; Google's help page lets you choose your autofill provider for Chrome on Android.

On a Chromebook, or in Chrome on any computer.

1. Open Chrome.
2. Click More (the three dots at the top right).
3. Click Passwords and autofill.
4. Click Google Password Manager.

In short: Chrome > More > Passwords and autofill > Google Password Manager, or passwords.google.com in any browser.

On a Windows computer. Microsoft's password manager is in the Edge browser. It works when Edge is signed in with a personal Microsoft account (Microsoft Support, View or edit your passwords in Microsoft Password Manager).

1. Open Microsoft Edge.
2. Select the three dots at the top right, next to your profile picture.
3. Select Settings.
4. Select Passwords and autofill.
5. Select Microsoft Password Manager.

In short: Edge > three dots > Settings > Passwords and autofill > Microsoft Password Manager. Microsoft says that editing a saved password in Edge does not change it on the website; change it on the site too.

If you followed older guides: Microsoft Authenticator no longer fills passwords. Microsoft says Authenticator's autofill was discontinued in mid-August 2025 (Microsoft Support, Microsoft Authenticator FAQs). Authenticator still makes sign-in codes and prompts, which Two-step sign-in and passkeys uses. Product-specific

Run the password check

Apple's and Google's managers each have a check that lists saved passwords that are reused, easy to guess, or found in a breach. The check sees only the passwords saved in that manager. Run it after the manager has been on for a while, or after you have signed in to your main accounts once with it on.

Apple Passwords (iPhone, iPad or Mac):

1. Open the Passwords app.
2. Tap Security.
3. Read the list. Apple flags passwords that are easy to guess, used for more than one account, or in known data leaks.

In short: Passwords > Security. To change one, tap the account, then Change Password, and change it on the website. The leak warnings can be turned on or off in Settings > Apps > Passwords > Detect Compromised Passwords.

Google Password Checkup (any browser):

1. Go to passwords.google.com and sign in.
2. Select Go to Password Checkup.
3. Select Check passwords.
4. Read the three lists: compromised, reused and weak.

In short: passwords.google.com > Go to Password Checkup > Check passwords. In Chrome: More > Passwords and autofill > Google Password Manager > Checkup. Google says to change compromised passwords as soon as you can (Google Account Help, Change compromised passwords).

Microsoft Password Manager in Edge: the Microsoft page we read does not describe a reuse check, so we give no steps for one. If you use Edge only, check by hand, as for a password book below.

A password book: read down the book with the account list beside you. Any two accounts whose passwords match, or differ only by a number or a letter at the end, count as sharing a password. Test it

Then open the account list. For each account, choose where its password is kept in "Password kept in," and tick "Used nowhere else" only for accounts whose password no other account shares. Write where a password is kept, not the password. Our convention

A password book

A password book is a notebook, kept at home, with one entry per account. This manual offers it as a real option, not a fallback. NCSC says writing passwords in a journal or dedicated password book "can suit certain scenarios," such as people who get regular help from family to manage their accounts, and that it can be done safely because an attacker would need physical access to where the book is kept (NCSC, Managing your passwords). NCSC's three-random-words page says the same: writing a password down is OK if you keep it somewhere safe. EFF says different passwords written on paper and kept in a secure place are better than one password reused everywhere. Convention

NCSC's conditions are the rule for a book in this manual:

1. The passwords in it are still long and different. A book makes a different password for each account easy to keep. It does not make a short or guessable one safe. Use the four-word or 15-character rule.
2. The email password is strong and separate, as for everyone.
3. Check each service's terms. NCSC notes that some online banking services forbid writing passwords down. Your bank's or credit union's account agreement says. Ask your bank
4. Think about who can enter the room. Anyone who can reach the book can copy it, possibly without you knowing. NCSC says simply hiding it may not be enough if people have access to the room where it is kept.
5. Check the website yourself before you type. A book has no autofill, so it cannot warn you about a fake site. Type the address yourself or use a bookmark you made, rather than a link in a message.

A book has one more limit: it is one copy. If it is lost or burned, the passwords in it are gone with it, so your recovery phone and email from Getting back in are what get you back in. Keep the book away from the printed backup codes from Two-step sign-in and passkeys, so one lost bag or drawer does not hold both a password and the codes that get past two-step sign-in. Our convention

4. Changing passwords: email first, then money

Change passwords in order of what each one opens. This manual's order is: the main email, then the money accounts, then the phone company, then the device account (Apple, Google or Microsoft), then the rest as you next use each one. Our convention

Change the main email password

Before you start, check that the recovery phone and recovery email on the account are current (Getting back in). Then:

1. Make the new password: four or more random words, or let the manager generate 15 or more characters.
2. If you keep a book, write it in the book before you change anything, so it is on paper if the screen closes.
3. Change the password on the provider's own page, using the steps below.
4. If your manager offers to save or update the password, accept.
5. Sign out of the email on one device, then sign in again with the new password, to prove it works.

The provider's own steps, read from each provider's help pages on 2026-10-19:

Three notes from those pages. Google asks for a password you have not used before with that account, and signs you out everywhere except the devices you use to confirm it is you. Apple may ask you to wait an hour if Stolen Device Protection is on (Your phone and tablet). Microsoft says its support agents are not allowed to send password reset links, so anyone who offers to send you one is not Microsoft. Product-specific

Money accounts next

Next, change the passwords on your bank, credit card and money app accounts, one at a time, each to its own new password. Use the bank's own app or type the bank's address yourself; do not follow a link in an email or text to do it. If you keep a book, read your bank's account agreement first. If it forbids writing the password down, keep that one in the manager only, or ask the bank what it allows. Ask your bank

After each change, update the account list: "Password kept in" and "Used nowhere else." The rest of the reused accounts can wait until you next sign in to each one; change each then. Our convention

Security questions

A security question is a question such as "What was your first pet's name?" that some sites ask when you forget a password. True answers are often public or easy to find, which is why NIST tells services not to prompt people to use them. EFF says to give fictional answers that no one knows but you, such as a random password from your manager, and to keep them with the password. The FTC says to avoid questions whose answers are easy to guess or find, and to make the answers random and long. Convention

For a site that still asks: make each answer a few random words, different for each site, and keep it where you keep that site's password, in the manager's notes or the book. AOL's help pages suggest deleting security questions in favor of a recovery phone or email where it offers that.

The few things to remember

A manager or a book holds the rest, but a few passwords need to be in your head, because they open the place where the others live. EFF lists the device passcode, the password manager's main password and the email password among them. In this manual that means:

• the passcode that unlocks your phone (Your phone and tablet),
• the password for your main email, which for Gmail or iCloud users is also the device account,
• the main password of a third-party manager, if you use one.

This is where random words help most. Four or more random words with a short story to link them are easier to remember than 15 random characters. Practice typing the email password a few times this week. If you keep a book, it holds a copy for the day you forget.

5. See it See it

Free pages that show the same steps in each publisher's own words:

• NCSC, Managing your passwords: built-in and third-party managers, and the conditions for a password book.
• EFF, Dice-Generated Passphrases: the dice method with the word lists linked.
• Apple Support, Use the Passwords app: AutoFill, iCloud Keychain, shared groups and the Security list.
• Google Account Help, Change compromised passwords: Password Checkup and its three result types.

6. Practice Practice

Minimum: one place chosen for passwords, the main email's password changed to four or more random words or 15 or more characters, saved or written, signed in once, and the account list marked for reuse. Time: about 30 minutes, plus 10 minutes for each money account. Materials: your phone or computer; the account list, open or printed; your password book and a pen, if you keep one; five dice, if you want to roll words. Write where each password is kept on the account list, not the password itself.

1. Check recovery first. Open the recovery sheet from Getting back in and confirm the main email's recovery phone and email were checked.
2. Choose the place. Turn on the built-in manager on your phone (steps by device), or pick the notebook that will be your password book and decide where it lives.
3. Make the email password. Roll four or more words with dice, or let the manager generate 15 or more characters.
4. Write it in the book first, if you keep one.
5. Change it on the provider's page (the table above).
6. Save it in the manager if the manager offers.
7. Sign out and sign in once with the new password on one device.
8. Run the check. In Apple Passwords tap Security, or go to passwords.google.com and select Go to Password Checkup. With a book, compare the entries by eye.
9. Mark the account list. Fill in "Password kept in" for each account, and tick "Used nowhere else" for the email and any other account with its own password.
10. Change the first money account, then mark it on the list.

7. Your setup Your setup

The box below reads how you keep passwords now, your devices and your email. It shows the manager steps for your devices and the change-password steps for your email.

8. Check your work Check your work

Criteria

• Is the main email's new password four or more random words, or 15 or more characters, and used by no other account?
• Is it saved in the manager or written in the book, and have you signed in once with it?
• Does the account list say where each password is kept, without any password on it?
• Does the account list mark which accounts still share a password?
• If you keep a book: do you know where it lives, who can reach it, and whether your bank's terms allow it?
• Is at least one money account changed, or a time set to change it this week?

Worked example

Ruth's account list (fictional) shows Gmail with "Password book" and "Used nowhere else" ticked, and six accounts marked as sharing the old password. She has signed in once with the new Gmail password. The credit card password is changed and saved in Passwords and the notebook. The credit union password is changed and saved in Passwords only, with the note "check account agreement" in the Notes column. That meets the criteria: the email password is new, random and separate; the place is chosen; the reuse is marked. It does not settle the credit union question, which waits on the agreement, and it does not protect Gmail against a stolen password until two-step sign-in is on in Two-step sign-in and passkeys.

Common mistakes

• Changing one number at the end. Garden2019 to Garden2020 is the same password to anyone who saw the old one. Make a new one.
• Making up the words. Words you choose tend to be predictable. Use dice or the manager's generator.
• Changing the email password before checking recovery. If the new password is lost before it is saved, recovery is the way back in. Do Getting back in first.
• Writing a password on the account list. The list says where a password is kept. It is printed and stored in the browser, so a password does not belong on it.
• Changing every password at once. A long session leads to mistakes. Do the email and the money accounts; change the rest as you next use each.
• Trusting a page because it looks right. With a book, there is no autofill to notice a fake site. Type the address yourself.

What is still unresolved

This chapter does not settle whether any account is safe. A new password does nothing about a password already stolen from a site you have not changed yet, or about someone who talks you out of a code; Two-step sign-in and passkeys adds two-step sign-in and Recognizing scams covers scams. Your bank settles whether its terms allow a written password. You decide who in your home may see a password book. Which third-party manager to use, if any, is your choice; this manual does not rate them.

9. Knowledge check and scenario

Checklist

• The built-in password manager is on, or a password book is chosen with its place and conditions.
• The main email has a new password of four or more random words or 15 or more characters, used by no other account.
• The new email password is saved in the manager or written in the book, and I have signed in once with it.
• The password check is run, and the account list marks which accounts still share a password.
• The money accounts' passwords are changed, or a time is set this week to change them.
• Security question answers on one site replaced with random words kept with that password. (Go deeper; optional)
• A six-word passphrase made with dice and compared in the passphrase calculator. (Go deeper; optional)
• Any exported password file from an old manager is deleted. (Go deeper; optional)