The advice you keep hearing is to use a long, different password for every account. That advice is correct. It is also completely impossible if you are relying on your memory, and pretending otherwise helps nobody.
So here is how people actually manage it.
Why one password everywhere is the real danger
Companies get broken into. Not small ones you have never heard of, big ones. When that happens, the list of email addresses and passwords gets passed around.
If you use the same password for the shop you bought a garden chair from and for your email, then whoever has that list now has your email. And your email is the master key: it is where every “reset my password” message goes. Lose your email and you lose everything else with it.
That is the whole reason for different passwords. Not because someone is guessing yours. Because somewhere else was careless with it.
Writing them down is not the sin you were told it was
For years people were told never to write a password down. That advice was written for offices, where the risk was a colleague reading a note on your desk.
At home the danger is somebody on the other side of the world with a stolen list, not a burglar leafing through your notebook. A small book kept in a drawer, out of sight, is far safer than using Rover1 for everything.
If you do keep a book: use one, keep it in the same place, and tell one person you trust where it is. A password nobody can find after you are gone causes real distress to families, and I have sat with people trying to sort exactly that.
The better answer, if you are willing
A password manager is a program that remembers them all and fills them in for you. You learn one strong password, and it handles the rest.
The honest pros and cons.
For: every account gets a long, unique password without you doing anything. It fills them in, so no typing. It tells you when a site you use has been broken into. It works on your phone and your computer together.
Against: there is an afternoon of setting up. And there is a nervousness about putting everything in one basket, which I understand entirely, even though the basket is a great deal stronger than the alternative.
Your phone and computer almost certainly have one built in already, from Apple or Google, and it is free. If you have ever seen a box offering to save a password, that was it asking.
Making a password you can actually say
If you are doing it by hand, forget the old advice about swapping letters for symbols. P@ssw0rd is not clever, and computers unpick it instantly.
Length beats complication. Three or four unrelated words joined together is both stronger and easier: kettle-harbour-thistle. That is genuinely harder to break than a short mess of symbols, and you can tell it to somebody down the phone.
Do not use anything anybody could learn about you. Not your road, your dog, your children, or the year you were born.
The three that matter most
If you do nothing else, protect these three, and give each its own password nothing else shares:
- Your email. Everything else can be reset through it, so it is the one that matters most and the one people protect least.
- Your banking. For obvious reasons.
- Your Apple or Google account. This holds your photographs, your contacts and your backups.
Everything else can wait. Those three, this week.
The extra lock worth turning on
Two-step verification means that after your password, the account sends a short code to your phone. Somebody with your password but not your phone gets nowhere.
It is mildly annoying and it is the single most effective thing you can do. Turn it on for those same three accounts.
If you would like a hand with any of it, bring the device to the Friday clinic or give me a ring. Setting up a password manager together takes about half an hour, and you will not have to think about it again.