Strong passwords and multi-factor authentication
In short: Use long, unique passphrases, store them in a password manager, and turn on multi-factor authentication. MFA stops most account takeovers even when a password leaks.
What makes a password strong?
- Length beats complexity. A 16-character passphrase is far stronger than an 8-character jumble.
- Unique for every account. If one site leaks, the others stay safe.
- Not personal or common. Avoid names, birthdays, "Password123" and keyboard patterns.
A passphrase of four or more random words, such as lamp-orbit-cactus-river, is easy to remember and hard to guess. Try the free password generator and strength checker.
Use a password manager
Nobody can remember 100 unique passwords. A password manager stores them encrypted, fills them in for you and warns you about reused or leaked ones. You only remember one strong master password.
Turn on multi-factor authentication (MFA)
MFA asks for a second proof after your password:
| Method | Strength |
|---|---|
| Security key or passkey | Strongest, and resistant to phishing |
| Authenticator app (code or push prompt) | Strong, and good for most people |
| SMS text code | Better than nothing, but can be intercepted |
Turn it on first for email (it can reset all your other accounts), then banking, social media, cloud and admin accounts.
Warning signs
- An MFA prompt you didn't request: deny it and change your password.
- Never share a code with anyone, even "support". Real support teams never ask for it.
Real-world example: a leak from an old shopping site
Years ago, Sara created an account on a small online shop using the same password as her email. That shop is later breached and its customer list, including passwords, is passed around online. Attackers routinely try leaked email-and-password pairs on popular services, hoping people reused them.
One evening, Sara's phone shows a sign-in approval prompt for her email that she did not start. Because she had turned on MFA, the attacker's correct password was not enough. She taps Deny, then changes her email password to a new passphrase and lets her password manager create unique passwords for her other accounts.
Without MFA, that single reused password could have given the attacker her email, and from there the "forgot password" links for her other accounts.
Try this: open your email account's security settings and check that 2-step verification is on. If you use a password manager, run its check for reused or weak passwords and fix the most important accounts first.
Key takeaways
- Long, unique passphrases beat short complex passwords.
- A password manager makes unique passwords easy.
- Turn on MFA everywhere, starting with email.
- Never share MFA codes and deny unexpected prompts.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.