Passwords & account safety: lock down your accounts

Most break-ins don't crack a clever password — they reuse one that already leaked somewhere else. The good news: protecting yourself is simpler than it sounds, and your Mac, iPhone, or PC can do nearly all of the work for you.

Why this matters

The real danger isn't a weak password — it's a reused one. When a website you used years ago gets breached (and big companies are breached all the time), that password ends up on a list criminals try everywhere else. If you've used it — or a small variation — on your email or bank, one old leak can unlock everything. And your email is the master key: whoever controls it can reset the password on most of your other accounts. So the goal is simple: a different, strong password on every important account, plus a second lock on the ones that matter most.

Strong, unique passwords

Just two rules, and the first is easier than you've been told:

• Long beats complicated. A passphrase of a few unrelated words — like purple-tractor-velvet-lake — is both very strong and easy to type. Length matters more than odd symbols.
• Different everywhere. Use a unique password for each important account, so a single leak can't spread. You won't have to remember them all — that's the next step's job.

Let your devices do the remembering

Here's the part that makes everything else painless — and you may already have it without realizing. A "password manager" simply makes up strong passwords for you, keeps them safe, and types them in when you sign in, so you never have to remember them.

On a Mac, iPhone, or iPad, you already have an excellent one built in — the Passwords app (backed by iCloud Keychain). Turn it on once and it works across all your Apple devices:

1. System Settings → [your name] → iCloud → Passwords → turn on Sync this Mac. (On an iPhone or iPad it's Settings → [your name] → iCloud → Passwords.)
2. From then on, when a website asks you to pick a password, let it suggest a strong one and tap Save — no thinking them up or memorizing required.

On Windows, the easiest option is one you're probably using already: your web browser. If you browse with Google Chrome or Microsoft Edge, it offers to remember each password the first time you sign in — just click Save, and it fills it in for you next time. That one habit already puts you far ahead of reusing the same password everywhere.

Want one place for everything, on every device? A dedicated password manager keeps your passwords together across Apple, Windows, Android, and any browser — handy if your household is a mix. You have plenty of good choices; popular, well-regarded ones include 1Password and Bitwarden. Whichever route you take, the idea is the same: let it remember the many; you remember one strong primary password.

Turn on two-factor authentication (2FA)

Even a great password can leak. Two-factor authentication adds a second step at sign-in — usually a code from your phone — so a stolen password alone isn't enough to get in. Turn it on for your most important accounts first: your email, your bank, and your Apple or Microsoft account. A code from your Apple devices or an authenticator app is more secure than a text message — but any two-factor is far better than none.

Check if you've been in a breach

You can actually find out whether your information has turned up in a known breach. Visit Have I Been Pwned, type in your email address, and it'll tell you which known breaches included it. If yours shows up — it's not your fault, breaches happen — just change the password on those accounts, and anywhere you reused it. (With a password manager, that's a five-minute job.)

A few more good habits

• Never email, text, or read out a password — and remember, no real company asks for your password by phone or popup (that's a scam).
• If you think an account's been compromised, change its password from a trusted device and switch on two-factor.
• Watch for passkeys — the newer, even-safer replacement for passwords. Your devices already support them, and you'll see more sites offer them.

Let me get you set up

Turning on iCloud Keychain (or a manager), switching on two-factor for your key accounts, and cleaning up the passwords you've reused over the years is quick to do together — and one of the biggest peace-of-mind upgrades there is. I'm glad to walk you through it on your Mac, PC, or phone. Start a remote session or get in touch.