Lesson 2 of 9 · about 15 minutes

Passwords, Password Managers and Passkeys

You'll be able to

Explain why password reuse is the single most common way accounts fall
Make a strong passphrase and show the arithmetic behind its strength
Set up and organize a password manager, starting with the accounts that matter most
Describe what a passkey is and why it resists phishing

Most accounts do not get "hacked" in any clever sense. Someone logs in with the right password, because the owner used that password somewhere else and that somewhere else leaked. The breach-tracking site Have I Been Pwned lists more than 17.8 billion breached accounts from over 1,000 breached sites (as of October 2026). Odds are good your email is in there. Go check. It takes ten seconds and is mildly horrifying.

Criminals feed those lists into software that tries each email and password pair on banks, email providers and social sites. That is credential stuffing, and it works because people reuse passwords. One unique password per account kills it dead.

What the federal standard now says

The National Institute of Standards and Technology publishes the password rules federal agencies follow, and many companies copy them. The 2025 revision, SP 800-63B-4, threw out several habits that IT departments loved for twenty years.

Old habit	NIST SP 800-63B-4
8 characters is enough	At least 15 characters when the password is the only factor. At least 8 when used with a second factor.
Must include a capital, a number and a symbol	Sites SHALL NOT impose composition rules like these
Change it every 90 days	Sites SHALL NOT require periodic changes. Change only after evidence of compromise.
Block pasting into the password box	Sites SHALL allow password managers and autofill, and SHOULD allow paste
Security questions ("Mother's maiden name?")	Knowledge-based questions are not allowed
No check against leaked lists	New passwords must be screened against common and compromised passwords

Composition rules produced Summer2024! and its thousand cousins. Forced changes produced Summer2025!. Length and uniqueness do the real work.

The arithmetic of a strong passphrase

You need exactly one password you can remember: the one that opens your password manager. Make it a passphrase of random words. Random matters. Song titles and Bible verses are in attackers' dictionaries.

Example: words versus symbols

EFF publishes a list of 7,776 words for picking passphrases with dice (EFF dice page). Roll five dice, look up the word, repeat.

Each word is one choice out of 7,776. In bits, that is log2(7,776), about 12.9 bits per word.
Six words: 6 x 12.9 = about 77.5 bits. The number of possible phrases is 7,776 to the sixth power, about 2.2 x 10^23.
Compare a random 8-character password using all 94 printable keyboard characters: 94 to the eighth power is about 6.1 x 10^15, or about 52 bits.

Now assume an attacker with a stolen database of a fast, weakly protected hash who can try 100 billion guesses per second (real rates vary enormously, and well-run sites use slow hashes that cut this by many orders of magnitude):

8 random characters: 6.1 x 10^15 / 10^11 = 61,000 seconds, about 17 hours to try them all.
Six random words: 2.2 x 10^23 / 10^11 = 2.2 x 10^12 seconds. Divide by about 31.6 million seconds per year: roughly 70,000 years.

A phrase like crumb anvil pelican sixty boxer tundra is easier to type on a phone than r#8Lq!2v and astronomically harder to guess. (Do not use that one. It is now on the internet.)

Picking and setting up a password manager

A password manager generates a unique random password for every site, stores them encrypted, and fills them in for you. Common choices include Bitwarden, 1Password, Proton Pass, and the managers built into Apple devices (the Passwords app) and Google accounts. Any reputable one beats a notebook of reused passwords. Look for these things:

End-to-end encryption, so the company cannot read your vault.
Two-factor support on the manager account itself, ideally a security key or passkey.
Works on all your devices, including the browser you actually use.
Export, so you can leave later.
Emergency or recovery options you understand before you need them.

The 2022 LastPass breach is the case study. LastPass said attackers copied backups of customer vaults. Passwords and notes were encrypted with a key derived from each user's master password, but website URLs were stored unencrypted (LastPass notice). Two lessons. A strong master passphrase is what stands between a stolen vault and your accounts. And even the list of sites you use can reveal things, such as which small-town utility portal a writer logs into.

Common mix-ups

Claim: "Putting all my passwords in one place is putting all my eggs in one basket." What the evidence shows: The alternative is reuse, which puts your eggs in hundreds of baskets that leak. One basket guarded by a long passphrase and a security key is far safer.
Claim: "My browser saves passwords, so I already have a manager." What the evidence shows: Browser managers count if they sync with encryption and you use unique generated passwords. Saving the same reused password in Chrome changes nothing.
Claim: "Changing all my passwords every few months keeps me safe." What the evidence shows: NIST dropped forced periodic changes because they push people to predictable patterns. Change a password when a site is breached or you suspect trouble.

The migration order

Nobody converts 200 accounts in one sitting. Go in this order, and let the rest get fixed as you log in over the next few months:

Your main email account (it can reset everything else)
The password manager account itself
Your phone carrier account and Apple or Google account
Banking and payment accounts
Domain registrar, web host and newsletter platform
Social media accounts you publish from
Cloud storage holding notes or recordings

Passkeys

A passkey replaces the password entirely. The FIDO Alliance, the industry group behind the standard, describes it as a credential "that can be stored on your phone or computer" (FIDO Alliance). When you create one, your device makes a key pair. The site keeps the public half. The private half stays on your device or in your password manager, and you approve each sign-in with your fingerprint, face or device PIN.

Why writers should care: a passkey is bound to the real site's address. If a phishing email sends you to a look-alike login page, your device has no passkey for that fake address and offers nothing. There is no secret for you to type into the wrong box. FIDO calls phishing resistance "a core design goal."

	Password	Synced passkey	Device-bound passkey (security key)
Can be phished	Yes	No	No
Leaks in a site breach	Hash can be cracked	Only the public key, useless to thieves	Only the public key
Survives losing a phone	Yes, if in a manager	Yes, synced through your provider's cloud	Only if you registered a spare key
Best for	Sites with no other option	Most everyday accounts	Email, password manager, registrar

Adoption is uneven. A 2024 FIDO-commissioned survey found 53 percent of people had turned on passkeys for at least one account. Where a site offers passkeys, use them. Keep a recovery method, such as printed backup codes, in case you lose access to the device or account that holds them.

Never put your master passphrase in the password manager's own notes, in an email to yourself, or in a cloud document. Write it on paper if you must and keep the paper at home in a place a burglar would not look first.

Checklist

Checked your email at Have I Been Pwned
Chose a password manager and turned on two-factor for it
Master passphrase: six or more random words, used nowhere else
Changed email, carrier, Apple or Google, bank and registrar passwords first
Added passkeys where offered, with a recovery option saved
Deleted old passwords from notes apps and spreadsheets

Try it

Make a six-word passphrase with real dice and the EFF list, or with your password manager's passphrase generator. Write out the strength math the way the example does. Then install a password manager, store your three most important logins in it, and change each of those passwords to a fresh generated one. Finally, look in your email account's security settings for a passkey option and add one if it exists. Note which accounts on your list offer passkeys and which still do not.

Check yourself

1. Under NIST SP 800-63B-4, what is the minimum length for a password used as the only factor?

2. What does NIST now say about forcing people to change passwords every 90 days?

3. A six-word passphrase drawn at random from the 7,776-word EFF list has about how many bits of strength?

4. In the 2022 LastPass breach, which data in the copied vault backups was NOT encrypted?

5. Why can't a fake login page steal a passkey the way it steals a password?

Terms in this lesson

Credential stuffing: Automated attacks that try usernames and passwords leaked from one site on many other sites.
Password manager: An app that creates, stores and fills a unique strong password for every account, locked by one master passphrase.
Passphrase: A password made of several random words, long enough to be strong and easy enough to type.
Passkey: A sign-in credential based on FIDO standards that uses a key pair stored on your device instead of a typed secret.
Entropy: A measure, in bits, of how many guesses a truly random password would take to find.

Full glossary

Sources

NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management checked 2026-10
FIDO Alliance, Passkeys checked 2026-10
LastPass, Notice of Recent Security Incident (December 22, 2022 update) checked 2026-10
FIDO Alliance, New survey: half of people use passkeys (World Password Day 2024) checked 2026-10
EFF Dice-Generated Passphrases checked 2026-10
Have I Been Pwned checked 2026-10