Passwords belong in a vault. Not a sticky note. Do this instead.
Use a different password for every account. A password manager keeps them, and you remember one passphrase.
Use a different password for every account so one stolen password can't unlock the others. Pick a password manager that you like, and turn on multi-factor authentication for the password manager and for other important accounts that offer it. The password manager encrypts the passwords and keeps them in one place. Add backup authentication methods so you are less likely to get locked out of the password manager. Those methods do not replace its passphrase.
Remember one
What it does
A password manager generates a new random password when you make an account, saves it, and fills it in when you sign in. CISA says it also tells you which of your passwords are weak or reused.
Settings illustrations are for reference. Labels and layout may vary by operating system version.
Let the password manager fill the password when you sign in. If the site blocks that, paste it in. NIST's guidelines for government sign-in systems support password managers because they help people use stronger passwords.
One place
Pick one
The choice is the password manager built into your browser, or a separate app. The browser one is already there. If you use several browsers, check that the password manager works with each one. CISA counts the browser's manager as a real option, alongside others that can cost money, and says to check a trusted reviewer and read reviews. The NSA is stricter: turn off the features that let websites and programs remember passwords, and use a password manager instead.
The one you keep
Make the main passphrase count
The passphrase that opens the password manager is the one you have to remember. Use four to seven unrelated words, at least 16 characters, and don't use it anywhere else. Longer is stronger. That length is from CISA's password guidance.
Then turn on multi-factor authentication for the manager itself. The NSA says app- or device-based methods are stronger than a code by text or email, and to choose phishing-resistant options when they're offered.
Email first
Move your accounts in, most important first
Start with your email. Then your bank and every account that holds money. Then the rest as you sign in to them.
For each one, let the manager make a new password and save it. Turn on multi-factor authentication too. CISA says to turn it on especially for email, social media and financial accounts.
CISA's own example shows why email comes first: one reused password let a stranger into a bank account and the email account that would have reset it. That ordering is our reading of CISA's example.
No schedule
Security questions and password changes
When a site asks a security question, the NSA suggests a false answer that is unique and memorable to you, since real answers can be found online. Answers to these questions shouldn't sit anywhere in plain text, the NSA says, and it recommends a password manager. Save them in the manager with the account.
You don't have to change a password on a schedule. Change it when a site tells you it was exposed, or when the password manager flags it.
One passphrase, a second factor on the manager, email first. Every new account gets a password you never have to remember.
About the author
Editor in chief, The Bravo Protocol
Real-world experience as VIP security, engineer, and United States Marine. Classically trained in Information Management, Security, and Network Assurance with a specialization in IT forensics.
An expert advisor that's led teams and engineering initiatives for Fortune 500 companies and an AI/ML unicorn startup.
Show the receipts
Sources and notes
What each source supports in this guide. Pages opened Nov 6, 2026.
US government
- Use Strong Passwords, CISA Secure Our World (archived page, still online). Long, random, unique passwords; nobody can remember one for every account; what a password manager does, including flagging weak and reused passwords; the browser's built-in password manager is one option, and some others cost money; check a trusted reviewer and read reviews; a passphrase of four to seven words and at least 16 characters, longer is stronger; multi-factor authentication for email, social media and financial accounts; the example of one reused password opening a bank account and an email account.
- NIST SP 800-63B-4, Authentication and Authenticator Management, NIST. Guidance for government sign-in systems: verifiers shall allow password managers and autofill, and should allow paste; a password manager makes stronger passwords more likely; require a change when there is evidence of compromise rather than on a schedule; a minimum of 15 characters when a password is the only factor.
- Best Practices for Securing Your Home Network, NSA (Feb 2023). Use a password manager; disable features that let websites or programs remember passwords, and use a password manager instead; app- or device-based multi-factor over phone or email confirmation, and phishing-resistant options when available; false but memorable answers to security questions; answers not stored in plain text.
Our calls
Every line marked "Our call" is our editorial judgment, resting on the sources above. Where we connect two facts a source didn't connect, the text says so.