If you use the same password, or a small variation of it, on lots of websites, you're in good company. You're also taking a real risk. When one company is breached, criminals take the leaked email and password combinations and try them on banks, email and shopping sites. It's called credential stuffing, and it works because so many people reuse passwords.
Why "remember them all" doesn't work
Nobody can remember dozens of long, unique passwords. So we reuse them, or add a number on the end, or keep them in a notebook or a note on the phone. A password manager solves the real problem: you only have to remember one.
What a password manager does
- It creates long, random passwords for every site, so you never have to think of one.
- It stores them securely, locked behind one strong master password.
- It fills them in for you on your computer and phone, and it won't fill in a password on a fake lookalike website, which makes it a handy scam defence too.
- It alerts you if one of your passwords turns up in a known breach.
Good ones include Bitwarden, 1Password, and the managers built into Apple, Google and Microsoft accounts. The right choice depends on which devices you use, and the best manager is the one you'll actually use.
Make the one password you remember a good one
Your master password is the only one you need to memorise, so make it long rather than clever. A string of four or five unrelated words is easier to remember and much harder to crack than a short jumble of symbols. Never use it anywhere else, and don't share it.
Turn on two-step login
Two-step login (also called two-factor or multi-factor authentication) asks for a second proof beyond your password, like a code from an app. Even if a criminal gets your password, they still can't get in. Where you have the choice, an authenticator app is safer than a text message code.
Fix these accounts first
You don't need to change everything in a day. Start with the ones that would hurt most if they were taken over:
- Your main email account. Anything else can be reset through it, so it's the master key. See Your email has been hacked if you think it already has been.
- Online banking and anything with a card attached.
- myGov and other government accounts.
- Your phone account (Apple ID or Google account).
- Social media and shopping accounts.
Never share a code
A code sent to your phone is for you alone. Anyone who rings, texts or emails asking you to read it out, including someone claiming to be your bank, is a scammer.
Want help setting it up?
Getting a password manager set up is a job that goes much faster with someone sitting beside you. We can help at home or in the office, move your existing passwords across, set up two-step login and make sure your email is secure. Call 1800 851 816 or book a visit. For businesses, see our cyber security checklist.
Related guides
Rather someone just fixed it?
Call us and describe what is happening. We will tell you what it is likely to be and what it would involve — before you commit to anything.
1800 851 816 Our servicesWritten by the technicians at Afford IT, Indooroopilly. We service homes and small businesses across Greater Brisbane.