Lesson 3 of 11 · about 24 minutes

Passwords, Two-Step Sign-In and Passkeys

You'll be able to

Build a long passphrase and explain why length and uniqueness matter more than symbols
Choose a password manager, including a free built-in one, and set it up safely
Turn on two-step sign-in and tell the weaker forms from the stronger ones
Explain what a passkey is and when to use one
Protect the accounts that matter first and plan for recovery

Start here. If a thief gets into your email, they can reset the password on nearly everything else you own. So start with the email account: give it a long, one-of-a-kind password and turn on two-step sign-in. Do that one thing today and you have done the most important part of this lesson. The rest makes it easier and stronger.

A password is a key. Most of us have too many keys, so we reuse one or two and make them short enough to remember. That is exactly what criminals count on. This lesson is about carrying fewer keys in your head, and making the ones you use hard to copy or fool.

What makes a good password

Forget the old advice about swapping an "a" for an "@" and adding an exclamation point. Modern guidance cares about three things: how long the password is, whether it is random, and whether it is used only once.

Length. The federal Cybersecurity and Infrastructure Security Agency (CISA) says strong passwords are at least 16 characters long, and longer is better.
Random. A mix of letters, numbers and symbols, or a passphrase of 5 to 7 random words. CISA gives both choices.
Unique. Never the same on two accounts. CISA says to change default passwords on new devices too.

The National Institute of Standards and Technology (NIST), which sets technical rules used by federal agencies, adds a few points in its 2025 guidelines. A password that is the only proof of who you are should be at least 15 characters. A password used only together with a second step may be shorter, but at least 8. Websites should not force odd rules like "one capital letter and one symbol," should not make you change your password on a schedule, should allow pasting and password managers, and should check new passwords against lists of common or leaked ones. Translation for you: you do not need to change passwords every 90 days. Change one when there is a reason, such as a breach notice or a suspected break-in.

Passphrases: easy to remember, hard to guess

A passphrase is a few random words strung together, for example "correct horse battery staple" (a famous sample, so do not use it) or something of your own like "lantern tractor pelican drizzle moss." The words must be random, not a song title or a line from your wedding vows.

Here is the arithmetic. Suppose you pick each word at random from a list of 7,776 words, the size of a well-known word list used for this purpose. Five words give 7,776 to the power of 5 possible phrases, which is about 28 quintillion (28 followed by 18 zeros). Compare a six-digit phone passcode, which has 1,000,000 possibilities. The five-word phrase has about 28 trillion times more. And it is far easier to remember than "q7$Zp!x2".

How to: make a passphrase you can remember

Pick five or six words at random. Open a book to a random page and choose a word with your eyes closed, or roll dice with a printed word list. Do not choose words that describe your life.
Put them in a row with spaces or hyphens between. Add a number or two if you like. Length does the real work.
Say it out loud ten times while you type it. Then use it for one thing only: your password manager, your email or your phone.
Do not write it where it can be found with your device. A paper copy in a locked drawer is better than reusing a weak one. Never keep it on a sticky note on the monitor.

Password managers in plain terms

A password manager is a protected vault. It makes a long, random, different password for each site, saves them, and fills them in for you. You remember one thing, the master password, which is the passphrase that opens the vault. It also warns when you land on a fake site, because it will not fill in a password on a web address that does not match the one you saved. Your phone and browser can already do this for free.

Choice	Cost	Good for	Watch out for
Apple Passwords (iCloud Keychain)	Free with an Apple Account	iPhone, iPad and Mac users. Fills in on all your Apple devices.	Works best inside Apple devices. Needs a strong Apple Account password and two-factor sign-in.
Google Password Manager	Free with a Google Account	Android phones and Chrome. Manage it at passwords.google.com.	Protect the Google Account itself with two-step sign-in, since it holds everything.
Bitwarden	Free plan: unlimited passwords and devices. Paid Premium was $19.80 a year as of October 2026, and adds emergency access and an authenticator.	People who use both Apple and Windows or Android devices	You must remember the master password. If you lose it, support cannot rescue it.
1Password and similar paid tools	Subscription (check the maker's page for the current price)	Families who want shared vaults and support	An annual fee. Compare with the free options first.
Browser managers (Chrome, Edge, Firefox, Safari)	Free	People who want the simplest start	Make sure the browser itself is locked with your device password
A paper notebook at home	Free	People who do not want any software	A fire, a move, or a visitor could cost you. Never carry it with you.

I name these because they are well known and the facts above come from their own pages. This course does not take payment from, or recommend, any maker. A free built-in manager that you actually use beats a paid one you set up and forget.

How to: set up a password manager (the simple way)

Pick one. If you only use Apple devices, turn on Passwords in your Apple Account. If you use Android and Chrome, use Google Password Manager. If you use a mix, try Bitwarden's free plan.
Protect it first. Make sure your Apple, Google or Bitwarden account has a long passphrase and two-step sign-in turned on.
Let it save what you already use. Next time you sign in to a site, say yes when it offers to save the password.
Fix the important ones first. Go to the site's account or security page, choose Change password, and let the manager suggest a long random password. Save it.
Use the manager's security check. Google and Apple both list reused, weak and leaked passwords. Fix the ones at the top.
Never type your master password into a link someone sent you. Never tell it to anyone, even support staff.

One more free check: haveibeenpwned.com, a long-running free site, lets you type your email address to see whether it turned up in a known data breach. If it did, change that password and any other place you used it.

Two-step sign-in

A password is "something you know." Two-step sign-in (also called two-factor or multi-factor authentication, MFA) adds "something you have," like your phone, or "something you are," like a fingerprint. Even if a thief steals your password, they cannot get in without the second item. CISA tells people to turn it on for every account that offers it. Its advice puts email accounts first, then banks and health care providers, and it says two-step sign-in guards banking information, online purchases and social media as well.

Second step	How strong	Plain notes
Passkey or security key	Strongest	Will not work on a fake look-alike site. CISA calls this family of methods (called FIDO) phishing resistant.
Authenticator app (a code that changes every 30 seconds)	Strong	Not tied to your phone number, so a SIM swap does not take it. Back it up before you change phones.
Prompt on your phone (tap Approve)	Good, with a catch	Never tap Approve for a sign-in you did not start. Thieves send many prompts hoping you tap one by mistake.
Code by text message	Better than nothing	Can be caught if a thief takes over your phone number, or talks you into reading it out. Use if it is the only choice.
Code by email	Weaker	Only as safe as the email account that receives it
Security questions (mother's maiden name)	Weak	Answers are often easy to find. Invent random answers and save them in your manager.

Never read a code to anyone. A bank, a store, Medicare, Apple, Google and Microsoft will never ask for the code that was just sent to you. A caller asking for it is using it to sign in as you, right now.

How to: turn on two-step sign-in

Google: go to myaccount.google.com, choose Security and sign-in, and turn on 2-Step Verification. Add a passkey or authenticator app if offered.
Apple: two-factor authentication is on for most Apple Accounts. On iPhone, check Settings, your name, Sign-In and Security. Apple requires it for passkeys.
Microsoft: sign in at account.microsoft.com, open Security, then Advanced security options, and add a sign-in method.
Your bank and others: open the website, find Security or Profile, and look for 2-step, two-factor or multi-factor. Choose an authenticator app or passkey if it offers one. Use text only if that is all there is.
When it asks, save the recovery codes (see below). Do this the same minute.

Passkeys

A passkey replaces your password. When you sign up for a site, your device makes a pair of keys: a public one that the site keeps, and a private one that stays on your device. Apple's own page explains that the server "never learns what the private key is." To sign in, you approve with your fingerprint, face or device passcode. There is nothing to type, nothing to guess and nothing to give away on a fake page.

Apple: passkeys sync across your Apple devices through iCloud Keychain, which is end-to-end encrypted. Apple requires two-factor authentication on the Apple Account to use them. If you lose all your devices, they can be recovered with your iCloud password, a text and your device passcode, with limits on attempts.
Google: passkeys are saved to your Google Account through Google Password Manager and work on devices where you are signed in. Chrome and Android may offer to make one when you sign in to a site where you saved a password. You can manage them at passwords.google.com.
Bitwarden: its free plan lists passkey management as one of its features.

When a site offers a passkey, say yes for important accounts such as email and banking, but keep your password and recovery method until you are sure the passkey works on your other devices too. Passkeys are new, and not every site has them yet. Use a passkey where you can and strong passwords with an authenticator app where you cannot.

Recovery codes and getting back in

The most common lockout is a lost phone. Plan for it before it happens.

When you turn on two-step sign-in, most services show a list of recovery codes. Each works once. Print the page or copy them on paper and keep it with your important papers. Do not keep them only on the phone that you could lose.
Add a second way in: a second phone number or a trusted family member's device, if the service allows.
For the authenticator app, find out how to move it to a new phone before you need to. Some apps offer an encrypted backup. Others need you to set it up again with each account.
Write down your Apple, Google and Microsoft account email addresses and where the recovery information is kept.

Which accounts matter first

Your main email. Every "forgot password" link goes here. If you have more than one, protect the one you use for banking and shopping first.
Your bank, credit card and retirement accounts. Also the app you use to pay friends.
Your phone company account. A thief who controls it can take over your number and catch your codes. Ask the company to add a PIN or passcode to your account. The phones lesson covers this.
Your Apple, Google and Microsoft account. They hold your photos, backups, saved passwords and often your payment cards.
Government and health accounts. My Social Security, Medicare.gov, your insurance and your doctor's patient portal. Lesson 8 covers these.
Shopping and streaming accounts. Saved cards live there.
Your password manager. Its master password and two-step sign-in guard everything.

Worked example: Dolores in Maple Ridge

Dolores, 68, lives in Maple Ridge (an invented town). Years ago she signed up for a quilting forum with her email address and the password "Sunflower2015." She used the same password for her email, her bank's website and a shopping site.

The forum is hacked and its list of passwords leaks. Within days, strangers try her email address and "Sunflower2015" on large email services. It works. Now they control her inbox. They click "Forgot password" at her bank and the reset link lands in the inbox they control. Two days later she gets a call from "her bank's fraud team," a number she does not know.

What it cost. $1,860 left her checking account in two transfers. The bank refunded $1,200 after a week of phone calls and forms, since it found the first transfer was not made by her. She lost $660. She spent about 12 hours on phone calls and new passwords.

What would have stopped it. A different password for each account would have kept the forum leak from spreading. Two-step sign-in on her email would have blocked the thieves even with the right password. Time to fix after the fact: about 90 minutes with a password manager and a helper.

Notice that the leak was not her fault. The forum was hacked. But the habit of reuse is what turned one small leak into a large loss.

Common mix-ups

Claim: "A password with symbols like P@ssw0rd! is strong." What the evidence shows: Common tricks like these are on the lists attackers try first. Length and randomness beat clever spelling.
Claim: "I should change my passwords every few months." What the evidence shows: NIST says websites should not force periodic changes. Change one when it may have been exposed.
Claim: "Putting all my passwords in one manager is risky because if it is hacked, I lose everything." What the evidence shows: A manager protected by a long master password and two-step sign-in is far safer than the usual alternative, which is reusing a few passwords everywhere. The weak point is the master password, so make it a good one.
Claim: "Two-step sign-in is too much trouble." What the evidence shows: It adds a few seconds, mostly on a new device. It stops many break-ins even after a password is stolen, which is why CISA lists it as a basic step.
Claim: "Text-message codes are useless." What the evidence shows: They are weaker than an app or passkey, but much better than a password alone. Use them if you must, and never read them out to a caller.

What never to do

Never tell a password or a code to anyone who contacted you. No bank, agency or tech company needs it.
Never use the same password for your email and anything else.
Never save passwords in a plain note with no lock on it, a photo or a spreadsheet named "Passwords" on a computer others use.
Never enter a password at a link sent by text or email. Type the website's address yourself or use a saved bookmark.
Never type a password on a page that appeared after a pop-up warning.
Never share your master password. Share a vault with a person only through the manager's own sharing feature.

Planning for the day you cannot sign in

A legacy contact is a person you choose, ahead of time, who can ask for access to some of your account data after you die. Apple lets you add a Legacy Contact under Settings, your name, Sign-In and Security, Legacy Contact. They need an access key you give them and a death certificate. Apple says that contact can see items such as photos, messages, notes, files and backups, but not iCloud Keychain data such as passwords and passkeys. So tell your family where the master password and recovery codes are kept, in a way that suits you. Google offers Inactive Account Manager at myaccount.google.com/inactive. You choose a waiting period, up to 10 people, and what to share. Google says that without a plan it may delete an account that has been inactive across Google for at least two years. The legacy lesson later in this course shows the full plan.

Do this today

Pick a passphrase of five or six random words for your email. Change the email password to it.
Turn on two-step sign-in for your email. Save the recovery codes on paper.
Turn on your phone's built-in password manager, or open Bitwarden's free plan.
Change the passwords for your bank and your main shopping site to long random ones from the manager.
Add a PIN or passcode to your phone-company account.
Write down, on paper, where your recovery codes and master passphrase are kept, and tell one trusted person where the paper is.
Type your email address at haveibeenpwned.com. If it was in a breach, change the password for that site and anywhere you reused it.

Questions and answers

How many passwords do I really need?

One for every account, but you will only remember three: your device passcode, your email passphrase and your manager's master password. The manager remembers the rest.

Is it safe to let my browser save passwords?

For most people, yes, if the device has a lock and an up-to-date system. A browser manager is much safer than reuse. Make sure no one else uses your sign-in, and do not let a shared family computer save your bank password.

What if I forget my master password?

For most managers, nobody can reset it for you, by design. Apple's FileVault page says a lost login password plus recovery key means your data is gone. Bitwarden works in a similar way. So write the master passphrase on paper and put it in a safe place, and set up recovery options the maker offers.

My bank only offers a text-message code. Is that okay?

Use it. It is better than nothing. Also ask your phone company to add a PIN to your account so that no one can move your number, and ask your bank if it offers an app, a security key or a passkey.

What is a SIM swap?

It is when a thief persuades or tricks your phone company into moving your number to a phone they control. Then your text codes go to them. A PIN on your phone account and an authenticator app or passkey for important accounts both help.

Can I share a password with my spouse or adult child?

Do not send it by email or text. Use the password manager's sharing feature, or a shared family vault. Bitwarden's free plan lets you share with one other person. For accounts such as Netflix, a shared password is fine, but never reuse it elsewhere.

A website says my password was found in a breach. What do I do?

Change that password now, and any other place you used it. Turn on two-step sign-in there. Check the website by typing its address, not by using a link in the message. Idaho law (Idaho Code 28-51-105) requires covered businesses to notify affected residents of a breach as soon as they reasonably can, but a notice can also be faked, so do not click a link in it.

Do I need a new password every time I get a new phone?

No. A manager moves with you when you sign in on the new phone. Set up your authenticator app on the new phone before you wipe the old one.

Hard questions

What if I cannot afford a password manager?

You do not need to pay. Apple Passwords, Google Password Manager and Bitwarden's free plan cost nothing, and a browser's built-in manager is free too. If you do not want any software, use a paper notebook at home with unique passwords for your email, bank and phone company, and keep it out of sight. That beats reusing one password.

Isn't a password manager a single point of failure? If it fails, I am done.

It is a single point, which is why you protect it with a long passphrase and two-step sign-in, and keep a paper copy of the recovery information. The alternative is dozens of passwords you cannot remember, so you reuse a few. Reuse fails more often than managers do. Still, your concern is fair. Keep an up-to-date paper list of your top five accounts and where the master passphrase can be found in an emergency.

I find all this too hard. What is the minimum?

Two things. Make a long, unique password for your email and turn on two-step sign-in there. Everything else can follow slowly. If you can have a family member or a trusted friend sit with you for one hour, you can finish the whole list in this lesson.

Are passkeys really better, or just the latest thing?

For fake-site tricks, they are better, because there is no password to hand over. Their weak points are new: you need a plan for lost devices, and not every site supports them. CISA recommends phishing-resistant methods for good reason. Use them where offered, and keep an authenticator-based fallback for a while.

Can someone force me to hand over my phone passcode or fingerprint?

The rules about when police or border officers may require a passcode or a fingerprint are complicated and vary by situation. This course does not cover them. If you are asked to open a device in a stressful situation, stay calm and follow the lawful instructions of the officer, and use the official agency pages for your situation. The travel lesson covers border crossings in general terms.

Reporting angle

If someone has your password or a code, or has taken over an account:

Change the password from a clean device. Start with email. Sign out other sessions from the security page if it offers that.
Call your bank on the number on your card if any money moved.
Report at ReportFraud.ftc.gov, at ic3.gov, and, if your identity was used, at IdentityTheft.gov.
For Idaho residents, the Attorney General's Consumer Protection Division takes complaints at ag.idaho.gov.

Keep evidence: screenshots of the sign-in alerts or "password changed" emails, the date and time, the phone number of any caller, and the text that held the code.

Research angle

CISA: Use Strong Passwords and CISA: Turn On MFA.
CISA: Implementing Phishing-Resistant MFA.
NIST SP 800-63B-4: the federal rules behind the password advice here.
Apple: security of passkeys and Apple: Legacy Contact.
Google: passkeys and Google: Inactive Account Manager.
Bitwarden: free plan details.
Have I Been Pwned.
FBI IC3 2025 report: phishing and spoofing led the complaint counts, with 191,561 complaints.

Check yourself

1. CISA recommends that passwords be at least how long?

2. Why is reusing one password on many sites so risky?

3. A caller says they are from your bank and asks you to read back the six-digit code just texted to you. What should you do?

4. Which form of two-step sign-in is generally considered the strongest?

5. What does Apple say a Legacy Contact cannot access?

6. Which accounts should you protect first with a strong password and two-step sign-in?

Terms in this lesson

Passphrase: A password made of several random words, easy to remember and long enough to be strong.
Password manager: A protected vault that creates, stores and fills in a different strong password for each of your accounts.
Master password: The one long password that opens your password manager. Make it a passphrase you remember and never reuse.
Two-step sign-in: A second proof after your password, such as a code or a prompt. Also called two-factor authentication or multi-factor authentication (MFA).
Authenticator app: A phone app that shows a fresh six-digit code every 30 seconds, used as the second step.
Passkey: A way to sign in with your fingerprint, face or device passcode instead of a password. Each account gets a matching pair of keys, and the secret one never leaves your device.
Recovery codes: One-time backup codes you save when you turn on two-step sign-in, used if you lose your phone.
Legacy contact: A person you name in advance who may request access to some of your account data after you die.

Full glossary

Sources

CISA, Secure Our World: Use Strong Passwords checked 2026-10
CISA, Secure Our World: Turn On MFA checked 2026-10
CISA, Implementing Phishing-Resistant MFA (fact sheet) checked 2026-10
NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management checked 2026-10
Apple Support, About the security of passkeys checked 2026-10
Google Account Help, Sign in with a passkey instead of a password checked 2026-10
Bitwarden, Pricing and free plan checked 2026-10
Apple Support, How to add a Legacy Contact checked 2026-10
Google Account Help, About Inactive Account Manager checked 2026-10
Have I Been Pwned, About checked 2026-10
FBI IC3 2025 Internet Crime Report checked 2026-10