Passwords and two-step verification

A password is the simplest way to prove who you are when signing in. Attackers often guess passwords: they try popular ones (123456, qwerty) or check every combination of characters one by one. So the longer and more unique a password is, the harder it is to crack.

A good password has at least 12 characters and contains no personal data such as a name, birth date or phone number. An easy-to-remember but hard-to-guess option is a long phrase made of several random words, for example “apple-river-book-rain” (this is only an example, never use it anywhere). The key rule: set a separate password for every site, otherwise a password leaked from one site may open your other accounts too.

Nobody can remember dozens of passwords, so use a password manager (for example, Bitwarden or KeePassXC). It keeps your passwords in an encrypted vault, and you only need to remember one master password. The master password must be very long and must never be shared.

Two-step verification (two-factor authentication, 2FA) asks for a second proof when you sign in, besides the password: something you have (a code on your phone or a security key) or something you are (a fingerprint). Even if your password is stolen, a criminal cannot get into the account without the second step. Authenticator apps (for example, Google Authenticator) refresh the code every 30 seconds; an SMS code also works but is less reliable. Never tell a verification code to anyone, even to a person who claims to be a “bank employee”.

Key takeaways

• A password should be long (at least 12 characters), unique and free of personal data.
• Use a separate password for every account so that one leak does not endanger them all.
• A password manager helps you store many passwords safely.
• Two-step verification protects the account even if the password is stolen.
• Never tell a verification code to anyone.