Passwords and 2FA, done right.

Here is an uncomfortable truth: most account break-ins don't happen because someone guessed a password. They happen because the password was reused somewhere else that got hacked — and criminals keep lists of billions of leaked passwords, and simply try them everywhere.

Passwords: two rules, that's all

1. Every important account gets its own password

Email, banking, and anything holding money are the ones that matter most. Why email first? Because whoever controls your email can reset the password of almost everything else. It is the master key.

2. Length beats cleverness

blue-boat-rainy-tea-42 is stronger than P@ssw0rd!23 and far easier to remember. Four or five random words joined together are both human-friendly and machine-hostile. A password manager (many are free) removes even the remembering.

2FA: the second lock

Two-factor authentication means logging in needs something you know (the password) plus something you have (your phone). Stealing one is not enough.

• Best: an authenticator app (Google Authenticator, Microsoft Authenticator, Authy). The code changes every 30 seconds and lives only on your phone.
• Good: a physical security key — the strongest option, common for serious accounts.
• Weakest (but still useful): SMS codes. Phone-number tricks can defeat them — use an app wherever an app is offered.

The step everyone forgets: recovery codes

When you switch on 2FA, the service shows you a set of recovery codes — a spare key for the day the phone is lost. Save them on paper, somewhere you keep important documents. Ten minutes with a pen now saves a lockout disaster later.

A quiet weekly habit

• Turn on authenticator-app 2FA for your email first, then your bank, then everything holding money.
• Once a month, glance at the "active sessions / logged-in devices" page of your important accounts and sign out anything you don't recognise.
• If a login alert arrives that wasn't you — change that password immediately, everywhere it was reused.