Strong passwords and two-step verification

A strong, unique password on each account, plus a second check when you sign in, stops most account break-ins. Here is how to build good passwords, store them safely, and turn on two-step verification on the accounts that matter most.

What you need

• About 15 minutes for your most important accounts. You can do the rest over a few days.
• Your phone, if you plan to use an authenticator app or text messages.
• A way to store passwords: a password manager, or the one built into your browser or phone.

Step 1: Make strong passwords

The US Cybersecurity and Infrastructure Security Agency (CISA) gives these rules:

• Use at least 16 characters. Longer is stronger.
• Use either a random mix of letters, numbers and symbols, or a passphrase of 4 to 7 unrelated words.
• Use a different password for every account, so one leak does not open the others.
• Avoid simple passwords, common words, birthdays and pet names.

A passphrase such as four random everyday words is easier to type than a jumble, and you can remember one or two. Do not pick words from a song, a quote or your family.

Step 2: Use a password manager

A password manager creates long random passwords, stores them, and fills them in. You remember only one strong password for the manager. CISA notes that built-in browser managers are free and paid ones exist.

1. Pick one manager: the one in your browser or phone, or a standalone one you chose yourself from the maker's official site.
2. Protect it with a very strong password that you have never used anywhere else, and turn on two-step verification for it.
3. When a site offers to suggest a password, accept it and let the manager save it.
4. Start by changing the passwords on your email, banking and shopping accounts, then work through the rest.

Step 3: Turn on two-step verification

Two-step verification (also called two-factor or multi-factor authentication) asks for a second proof after your password, such as a code or a tap on your phone. CISA recommends turning it on, especially for email, social media and financial accounts. Start with email, because it can reset your other accounts.

Google account

1. Go to your Google Account at myaccount.google.com and sign in.
2. Select Security & sign-in.
3. Under How you sign in to Google, select Turn on 2-Step Verification.
4. Follow the prompts on the screen.

If it is a work or school account, an administrator may control this setting. Ask them if the option is missing.

Microsoft account

1. Go to account.microsoft.com/security and sign in.
2. Select Manage how I sign in.
3. Under Additional security, find Two-step verification and select Turn on.
4. Follow the prompts. If you choose the authenticator app, you scan a QR code (a square pattern your phone camera reads) with your phone.

Microsoft says it is phasing out text messages as a method for personal accounts, so choose an app if you can. Microsoft also recommends having several ways to prove who you are, and warns that losing all your contact methods can mean waiting up to 30 days to regain access.

Apple Account

1. On an iPhone or iPad, open Settings then your name then Sign-In & Security.
2. On a Mac, open System Settings then your name then Sign-In & Security (macOS Ventura and later).
3. Turn on two-factor authentication and follow the prompts.

Apple says that if your account was created with two-factor authentication, it cannot be removed, and that if you turned it on recently you can go back only within two weeks of enrolling. Menu names change between versions, so use the Settings search box if you cannot find the entry.

Choose the second step carefully

A passkey signs you in with your fingerprint, face or device screen lock instead of a typed password. Google says signing in with one skips the second step because the passkey already proves it is you. Look for the option in your account's security settings.

Step 4: Protect your codes

• Save backup or recovery codes if the site offers them, and store them away from your phone. Google, for example, lets you print or download backup codes to use as the second step if you lose your phone.
• Add a second contact method, such as another email address, where the site allows it.
• Keep your phone number up to date with each account.

If you think a password is stolen

1. Change it right away from a device you trust. If you reused it elsewhere, change it there too.
2. Turn on two-step verification, as the Federal Trade Commission (FTC), a US government agency, advises.
3. If you cannot sign in, use the account's official recovery page.
4. If a stranger had access to your computer, read what to do if you gave someone remote access.

Frequently asked questions